kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

seccomp: replace types with runtime-spec types

Browse source 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn 2020-09-18 18:49:38 +02:00
parent 0efee50b95
commit 0d75b63987
No known key found for this signature in database
GPG key ID: 76698F39D527CE8C
4 changed files with 109 additions and 182 deletions
Download patch file Download diff file Expand all files Collapse all files

7
profiles/seccomp/default.json
View file

@ -416,7 +416,6 @@
{ {
"index": 0, "index": 0,
"value": 0, "value": 0,
"valueTwo": 0,
"op": "SCMP_CMP_EQ" "op": "SCMP_CMP_EQ"
} }
], ],
@ -433,7 +432,6 @@
{ {
"index": 0, "index": 0,
"value": 8, "value": 8,
"valueTwo": 0,
"op": "SCMP_CMP_EQ" "op": "SCMP_CMP_EQ"
} }
], ],
@ -450,7 +448,6 @@
{ {
"index": 0, "index": 0,
"value": 131072, "value": 131072,
"valueTwo": 0,
"op": "SCMP_CMP_EQ" "op": "SCMP_CMP_EQ"
} }
], ],
@ -467,7 +464,6 @@
{ {
"index": 0, "index": 0,
"value": 131080, "value": 131080,
"valueTwo": 0,
"op": "SCMP_CMP_EQ" "op": "SCMP_CMP_EQ"
} }
], ],
@ -484,7 +480,6 @@
{ {
"index": 0, "index": 0,
"value": 4294967295, "value": 4294967295,
"valueTwo": 0,
"op": "SCMP_CMP_EQ" "op": "SCMP_CMP_EQ"
} }
], ],
@ -625,7 +620,6 @@
{ {
"index": 0, "index": 0,
"value": 2114060288, "value": 2114060288,
"valueTwo": 0,
"op": "SCMP_CMP_MASKED_EQ" "op": "SCMP_CMP_MASKED_EQ"
} }
], ],
@ -650,7 +644,6 @@
{ {
"index": 1, "index": 1,
"value": 2114060288, "value": 2114060288,
"valueTwo": 0,
"op": "SCMP_CMP_MASKED_EQ" "op": "SCMP_CMP_MASKED_EQ"
} }
], ],

147
profiles/seccomp/default_linux.go
View file

@ -3,38 +3,39 @@
package seccomp // import "github.com/docker/docker/profiles/seccomp" package seccomp // import "github.com/docker/docker/profiles/seccomp"
import ( import (
"github.com/opencontainers/runtime-spec/specs-go"
"golang.org/x/sys/unix" "golang.org/x/sys/unix"
) )
func arches() []Architecture { func arches() []Architecture {
return []Architecture{ return []Architecture{
{ {
Arch: ArchX86_64, Arch: specs.ArchX86_64,
SubArches: []Arch{ArchX86, ArchX32}, SubArches: []specs.Arch{specs.ArchX86, specs.ArchX32},
}, },
{ {
Arch: ArchAARCH64, Arch: specs.ArchAARCH64,
SubArches: []Arch{ArchARM}, SubArches: []specs.Arch{specs.ArchARM},
}, },
{ {
Arch: ArchMIPS64, Arch: specs.ArchMIPS64,
SubArches: []Arch{ArchMIPS, ArchMIPS64N32}, SubArches: []specs.Arch{specs.ArchMIPS, specs.ArchMIPS64N32},
}, },
{ {
Arch: ArchMIPS64N32, Arch: specs.ArchMIPS64N32,
SubArches: []Arch{ArchMIPS, ArchMIPS64}, SubArches: []specs.Arch{specs.ArchMIPS, specs.ArchMIPS64},
}, },
{ {
Arch: ArchMIPSEL64, Arch: specs.ArchMIPSEL64,
SubArches: []Arch{ArchMIPSEL, ArchMIPSEL64N32}, SubArches: []specs.Arch{specs.ArchMIPSEL, specs.ArchMIPSEL64N32},
}, },
{ {
Arch: ArchMIPSEL64N32, Arch: specs.ArchMIPSEL64N32,
SubArches: []Arch{ArchMIPSEL, ArchMIPSEL64}, SubArches: []specs.Arch{specs.ArchMIPSEL, specs.ArchMIPSEL64},
}, },
{ {
Arch: ArchS390X, Arch: specs.ArchS390X,
SubArches: []Arch{ArchS390}, SubArches: []specs.Arch{specs.ArchS390},
}, },
} }
} }
@ -381,68 +382,68 @@ func DefaultProfile() *Seccomp {
"write", "write",
"writev", "writev",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
}, },
{ {
Names: []string{"ptrace"}, Names: []string{"ptrace"},
Action: ActAllow, Action: specs.ActAllow,
Includes: Filter{ Includes: Filter{
MinKernel: "4.8", MinKernel: "4.8",
}, },
}, },
{ {
Names: []string{"personality"}, Names: []string{"personality"},
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{ Args: []*specs.LinuxSeccompArg{
{ {
Index: 0, Index: 0,
Value: 0x0, Value: 0x0,
Op: OpEqualTo, Op: specs.OpEqualTo,
}, },
}, },
}, },
{ {
Names: []string{"personality"}, Names: []string{"personality"},
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{ Args: []*specs.LinuxSeccompArg{
{ {
Index: 0, Index: 0,
Value: 0x0008, Value: 0x0008,
Op: OpEqualTo, Op: specs.OpEqualTo,
}, },
}, },
}, },
{ {
Names: []string{"personality"}, Names: []string{"personality"},
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{ Args: []*specs.LinuxSeccompArg{
{ {
Index: 0, Index: 0,
Value: 0x20000, Value: 0x20000,
Op: OpEqualTo, Op: specs.OpEqualTo,
}, },
}, },
}, },
{ {
Names: []string{"personality"}, Names: []string{"personality"},
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{ Args: []*specs.LinuxSeccompArg{
{ {
Index: 0, Index: 0,
Value: 0x20008, Value: 0x20008,
Op: OpEqualTo, Op: specs.OpEqualTo,
}, },
}, },
}, },
{ {
Names: []string{"personality"}, Names: []string{"personality"},
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{ Args: []*specs.LinuxSeccompArg{
{ {
Index: 0, Index: 0,
Value: 0xffffffff, Value: 0xffffffff,
Op: OpEqualTo, Op: specs.OpEqualTo,
}, },
}, },
}, },
@ -450,8 +451,8 @@ func DefaultProfile() *Seccomp {
Names: []string{ Names: []string{
"sync_file_range2", "sync_file_range2",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Arches: []string{"ppc64le"}, Arches: []string{"ppc64le"},
}, },
@ -465,8 +466,8 @@ func DefaultProfile() *Seccomp {
"cacheflush", "cacheflush",
"set_tls", "set_tls",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Arches: []string{"arm", "arm64"}, Arches: []string{"arm", "arm64"},
}, },
@ -475,8 +476,8 @@ func DefaultProfile() *Seccomp {
Names: []string{ Names: []string{
"arch_prctl", "arch_prctl",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Arches: []string{"amd64", "x32"}, Arches: []string{"amd64", "x32"},
}, },
@ -485,8 +486,8 @@ func DefaultProfile() *Seccomp {
Names: []string{ Names: []string{
"modify_ldt", "modify_ldt",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Arches: []string{"amd64", "x32", "x86"}, Arches: []string{"amd64", "x32", "x86"},
}, },
@ -497,8 +498,8 @@ func DefaultProfile() *Seccomp {
"s390_pci_mmio_write", "s390_pci_mmio_write",
"s390_runtime_instr", "s390_runtime_instr",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Arches: []string{"s390", "s390x"}, Arches: []string{"s390", "s390x"},
}, },
@ -507,8 +508,8 @@ func DefaultProfile() *Seccomp {
Names: []string{ Names: []string{
"open_by_handle_at", "open_by_handle_at",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_DAC_READ_SEARCH"}, Caps: []string{"CAP_DAC_READ_SEARCH"},
}, },
@ -531,8 +532,8 @@ func DefaultProfile() *Seccomp {
"umount2", "umount2",
"unshare", "unshare",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_SYS_ADMIN"}, Caps: []string{"CAP_SYS_ADMIN"},
}, },
@ -541,13 +542,13 @@ func DefaultProfile() *Seccomp {
Names: []string{ Names: []string{
"clone", "clone",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{ Args: []*specs.LinuxSeccompArg{
{ {
Index: 0, Index: 0,
Value: unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET | unix.CLONE_NEWCGROUP, Value: unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET | unix.CLONE_NEWCGROUP,
ValueTwo: 0, ValueTwo: 0,
Op: OpMaskedEqual, Op: specs.OpMaskedEqual,
}, },
}, },
Excludes: Filter{ Excludes: Filter{
@ -559,13 +560,13 @@ func DefaultProfile() *Seccomp {
Names: []string{ Names: []string{
"clone", "clone",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{ Args: []*specs.LinuxSeccompArg{
{ {
Index: 1, Index: 1,
Value: unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET | unix.CLONE_NEWCGROUP, Value: unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET | unix.CLONE_NEWCGROUP,
ValueTwo: 0, ValueTwo: 0,
Op: OpMaskedEqual, Op: specs.OpMaskedEqual,
}, },
}, },
Comment: "s390 parameter ordering for clone is different", Comment: "s390 parameter ordering for clone is different",
@ -580,8 +581,8 @@ func DefaultProfile() *Seccomp {
Names: []string{ Names: []string{
"reboot", "reboot",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_SYS_BOOT"}, Caps: []string{"CAP_SYS_BOOT"},
}, },
@ -590,8 +591,8 @@ func DefaultProfile() *Seccomp {
Names: []string{ Names: []string{
"chroot", "chroot",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_SYS_CHROOT"}, Caps: []string{"CAP_SYS_CHROOT"},
}, },
@ -602,8 +603,8 @@ func DefaultProfile() *Seccomp {
"init_module", "init_module",
"finit_module", "finit_module",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_SYS_MODULE"}, Caps: []string{"CAP_SYS_MODULE"},
}, },
@ -612,8 +613,8 @@ func DefaultProfile() *Seccomp {
Names: []string{ Names: []string{
"acct", "acct",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_SYS_PACCT"}, Caps: []string{"CAP_SYS_PACCT"},
}, },
@ -625,8 +626,8 @@ func DefaultProfile() *Seccomp {
"process_vm_writev", "process_vm_writev",
"ptrace", "ptrace",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_SYS_PTRACE"}, Caps: []string{"CAP_SYS_PTRACE"},
}, },
@ -636,8 +637,8 @@ func DefaultProfile() *Seccomp {
"iopl", "iopl",
"ioperm", "ioperm",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_SYS_RAWIO"}, Caps: []string{"CAP_SYS_RAWIO"},
}, },
@ -648,8 +649,8 @@ func DefaultProfile() *Seccomp {
"stime", "stime",
"clock_settime", "clock_settime",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_SYS_TIME"}, Caps: []string{"CAP_SYS_TIME"},
}, },
@ -658,8 +659,8 @@ func DefaultProfile() *Seccomp {
Names: []string{ Names: []string{
"vhangup", "vhangup",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_SYS_TTY_CONFIG"}, Caps: []string{"CAP_SYS_TTY_CONFIG"},
}, },
@ -670,8 +671,8 @@ func DefaultProfile() *Seccomp {
"mbind", "mbind",
"set_mempolicy", "set_mempolicy",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_SYS_NICE"}, Caps: []string{"CAP_SYS_NICE"},
}, },
@ -680,8 +681,8 @@ func DefaultProfile() *Seccomp {
Names: []string{ Names: []string{
"syslog", "syslog",
}, },
Action: ActAllow, Action: specs.ActAllow,
Args: []*Arg{}, Args: []*specs.LinuxSeccompArg{},
Includes: Filter{ Includes: Filter{
Caps: []string{"CAP_SYSLOG"}, Caps: []string{"CAP_SYSLOG"},
}, },
@ -689,7 +690,7 @@ func DefaultProfile() *Seccomp {
} }
return &Seccomp{ return &Seccomp{
DefaultAction: ActErrno, DefaultAction: specs.ActErrno,
ArchMap: arches(), ArchMap: arches(),
Syscalls: syscalls, Syscalls: syscalls,
} }

72
profiles/seccomp/seccomp.go
View file

@ -1,11 +1,13 @@
package seccomp // import "github.com/docker/docker/profiles/seccomp" package seccomp // import "github.com/docker/docker/profiles/seccomp"
import "github.com/opencontainers/runtime-spec/specs-go"
// Seccomp represents the config for a seccomp profile for syscall restriction. // Seccomp represents the config for a seccomp profile for syscall restriction.
type Seccomp struct { type Seccomp struct {
DefaultAction Action `json:"defaultAction"` DefaultAction specs.LinuxSeccompAction `json:"defaultAction"`
// Architectures is kept to maintain backward compatibility with the old // Architectures is kept to maintain backward compatibility with the old
// seccomp profile. // seccomp profile.
Architectures []Arch `json:"architectures,omitempty"` Architectures []specs.Arch `json:"architectures,omitempty"`
ArchMap []Architecture `json:"archMap,omitempty"` ArchMap []Architecture `json:"archMap,omitempty"`
Syscalls []*Syscall `json:"syscalls"` Syscalls []*Syscall `json:"syscalls"`
} }
@ -13,66 +15,8 @@ type Seccomp struct {
// Architecture is used to represent a specific architecture // Architecture is used to represent a specific architecture
// and its sub-architectures // and its sub-architectures
type Architecture struct { type Architecture struct {
Arch Arch `json:"architecture"` Arch specs.Arch `json:"architecture"`
SubArches []Arch `json:"subArchitectures"` SubArches []specs.Arch `json:"subArchitectures"`
}
// Arch used for architectures
type Arch string
// Additional architectures permitted to be used for system calls
// By default only the native architecture of the kernel is permitted
const (
ArchX86 Arch = "SCMP_ARCH_X86"
ArchX86_64 Arch = "SCMP_ARCH_X86_64"
ArchX32 Arch = "SCMP_ARCH_X32"
ArchARM Arch = "SCMP_ARCH_ARM"
ArchAARCH64 Arch = "SCMP_ARCH_AARCH64"
ArchMIPS Arch = "SCMP_ARCH_MIPS"
ArchMIPS64 Arch = "SCMP_ARCH_MIPS64"
ArchMIPS64N32 Arch = "SCMP_ARCH_MIPS64N32"
ArchMIPSEL Arch = "SCMP_ARCH_MIPSEL"
ArchMIPSEL64 Arch = "SCMP_ARCH_MIPSEL64"
ArchMIPSEL64N32 Arch = "SCMP_ARCH_MIPSEL64N32"
ArchPPC Arch = "SCMP_ARCH_PPC"
ArchPPC64 Arch = "SCMP_ARCH_PPC64"
ArchPPC64LE Arch = "SCMP_ARCH_PPC64LE"
ArchS390 Arch = "SCMP_ARCH_S390"
ArchS390X Arch = "SCMP_ARCH_S390X"
)
// Action taken upon Seccomp rule match
type Action string
// Define actions for Seccomp rules
const (
ActKill Action = "SCMP_ACT_KILL"
ActTrap Action = "SCMP_ACT_TRAP"
ActErrno Action = "SCMP_ACT_ERRNO"
ActTrace Action = "SCMP_ACT_TRACE"
ActAllow Action = "SCMP_ACT_ALLOW"
)
// Operator used to match syscall arguments in Seccomp
type Operator string
// Define operators for syscall arguments in Seccomp
const (
OpNotEqual Operator = "SCMP_CMP_NE"
OpLessThan Operator = "SCMP_CMP_LT"
OpLessEqual Operator = "SCMP_CMP_LE"
OpEqualTo Operator = "SCMP_CMP_EQ"
OpGreaterEqual Operator = "SCMP_CMP_GE"
OpGreaterThan Operator = "SCMP_CMP_GT"
OpMaskedEqual Operator = "SCMP_CMP_MASKED_EQ"
)
// Arg used for matching specific syscall arguments in Seccomp
type Arg struct {
Index uint `json:"index"`
Value uint64 `json:"value"`
ValueTwo uint64 `json:"valueTwo"`
Op Operator `json:"op"`
} }
// Filter is used to conditionally apply Seccomp rules // Filter is used to conditionally apply Seccomp rules
@ -86,8 +30,8 @@ type Filter struct {
type Syscall struct { type Syscall struct {
Name string `json:"name,omitempty"` Name string `json:"name,omitempty"`
Names []string `json:"names,omitempty"` Names []string `json:"names,omitempty"`
Action Action `json:"action"` Action specs.LinuxSeccompAction `json:"action"`
Args []*Arg `json:"args"` Args []*specs.LinuxSeccompArg `json:"args"`
Comment string `json:"comment"` Comment string `json:"comment"`
Includes Filter `json:"includes"` Includes Filter `json:"includes"`
Excludes Filter `json:"excludes"` Excludes Filter `json:"excludes"`

55
profiles/seccomp/seccomp_linux.go
View file

@ -27,21 +27,21 @@ func LoadProfile(body string, rs *specs.Spec) (*specs.LinuxSeccomp, error) {
} }
// libseccomp string => seccomp arch // libseccomp string => seccomp arch
var nativeToSeccomp = map[string]Arch{ var nativeToSeccomp = map[string]specs.Arch{
"x86": ArchX86, "x86": specs.ArchX86,
"amd64": ArchX86_64, "amd64": specs.ArchX86_64,
"arm": ArchARM, "arm": specs.ArchARM,
"arm64": ArchAARCH64, "arm64": specs.ArchAARCH64,
"mips64": ArchMIPS64, "mips64": specs.ArchMIPS64,
"mips64n32": ArchMIPS64N32, "mips64n32": specs.ArchMIPS64N32,
"mipsel64": ArchMIPSEL64, "mipsel64": specs.ArchMIPSEL64,
"mips3l64n32": ArchMIPSEL64N32, "mips3l64n32": specs.ArchMIPSEL64N32,
"mipsle": ArchMIPSEL, "mipsle": specs.ArchMIPSEL,
"ppc": ArchPPC, "ppc": specs.ArchPPC,
"ppc64": ArchPPC64, "ppc64": specs.ArchPPC64,
"ppc64le": ArchPPC64LE, "ppc64le": specs.ArchPPC64LE,
"s390": ArchS390, "s390": specs.ArchS390,
"s390x": ArchS390X, "s390x": specs.ArchS390X,
} }
// GOARCH => libseccomp string // GOARCH => libseccomp string
@ -91,9 +91,7 @@ func setupSeccomp(config *Seccomp, rs *specs.Spec) (*specs.LinuxSeccomp, error)
// if config.Architectures == 0 then libseccomp will figure out the architecture to use // if config.Architectures == 0 then libseccomp will figure out the architecture to use
if len(config.Architectures) != 0 { if len(config.Architectures) != 0 {
for _, a := range config.Architectures { newConfig.Architectures = config.Architectures
newConfig.Architectures = append(newConfig.Architectures, specs.Arch(a))
}
} }
arch := goToNative[runtime.GOARCH] arch := goToNative[runtime.GOARCH]
@ -102,16 +100,14 @@ func setupSeccomp(config *Seccomp, rs *specs.Spec) (*specs.LinuxSeccomp, error)
if len(config.ArchMap) != 0 && archExists { if len(config.ArchMap) != 0 && archExists {
for _, a := range config.ArchMap { for _, a := range config.ArchMap {
if a.Arch == seccompArch { if a.Arch == seccompArch {
newConfig.Architectures = append(newConfig.Architectures, specs.Arch(a.Arch)) newConfig.Architectures = append(newConfig.Architectures, a.Arch)
for _, sa := range a.SubArches { newConfig.Architectures = append(newConfig.Architectures, a.SubArches...)
newConfig.Architectures = append(newConfig.Architectures, specs.Arch(sa))
}
break break
} }
} }
} }
newConfig.DefaultAction = specs.LinuxSeccompAction(config.DefaultAction) newConfig.DefaultAction = config.DefaultAction
Loop: Loop:
// Loop through all syscall blocks and convert them to libcontainer format after filtering them // Loop through all syscall blocks and convert them to libcontainer format after filtering them
@ -169,22 +165,15 @@ Loop:
return newConfig, nil return newConfig, nil
} }
func createSpecsSyscall(names []string, action Action, args []*Arg) specs.LinuxSyscall { func createSpecsSyscall(names []string, action specs.LinuxSeccompAction, args []*specs.LinuxSeccompArg) specs.LinuxSyscall {
newCall := specs.LinuxSyscall{ newCall := specs.LinuxSyscall{
Names: names, Names: names,
Action: specs.LinuxSeccompAction(action), Action: action,
} }
// Loop through all the arguments of the syscall and convert them // Loop through all the arguments of the syscall and convert them
for _, arg := range args { for _, arg := range args {
newArg := specs.LinuxSeccompArg{ newCall.Args = append(newCall.Args, *arg)
Index: arg.Index,
Value: arg.Value,
ValueTwo: arg.ValueTwo,
Op: specs.LinuxSeccompOperator(arg.Op),
}
newCall.Args = append(newCall.Args, newArg)
} }
return newCall return newCall
} }