kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

New seccomp format

Browse source 
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
This commit is contained in:
Antonio Murdaca 2016-07-13 15:41:30 +02:00
parent 8ccac1ad4d
commit 5ff21add06
No known key found for this signature in database
GPG key ID: B2BEAD150DE936B9
8 changed files with 1441 additions and 3406 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
daemon/seccomp_linux.go
View file

@ -32,7 +32,7 @@ func setSeccomp(daemon *Daemon, rs *specs.Spec, c *container.Container) error {
return nil
}
if c.SeccompProfile != "" {
profile, err = seccomp.LoadProfile(c.SeccompProfile)
profile, err = seccomp.LoadProfile(c.SeccompProfile, rs)
if err != nil {
return err
}

59
docs/security/seccomp.md
View file

@ -40,24 +40,65 @@ compatibility. The default Docker profile (found [here](https://github.com/docke
```json
{
"defaultAction": "SCMP_ACT_ERRNO",
"architectures": [
"SCMP_ARCH_X86_64",
"SCMP_ARCH_X86",
"SCMP_ARCH_X32"
"archMap": [
{
"architecture": "SCMP_ARCH_X86_64",
"subArchitectures": [
"SCMP_ARCH_X86",
"SCMP_ARCH_X32"
]
},
...
],
"syscalls": [
{
"name": "accept",
"names": [
"accept",
"accept4",
"access",
"alarm",
"alarm",
"bind",
"brk",
...
"waitid",
"waitpid",
"write",
"writev"
],
"action": "SCMP_ACT_ALLOW",
"args": []
"args": [],
"comment": "",
"includes": {},
"excludes": {}
},
{
"name": "accept4",
"names": [
"clone"
],
"action": "SCMP_ACT_ALLOW",
"args": []
"args": [
{
"index": 1,
"value": 2080505856,
"valueTwo": 0,
"op": "SCMP_CMP_MASKED_EQ"
}
],
"comment": "s390 parameter ordering for clone is different",
"includes": {
"arches": [
"s390",
"s390x"
]
},
"excludes": {
"caps": [
"CAP_SYS_ADMIN"
]
}
},
...
]
}
```

93
integration-cli/docker_cli_run_unix_test.go
View file

@ -1166,7 +1166,7 @@ func (s *DockerSuite) TestRunApparmorProcDirectory(c *check.C) {
// make sure the default profile can be successfully parsed (using unshare as it is
// something which we know is blocked in the default profile)
func (s *DockerSuite) TestRunSeccompWithDefaultProfile(c *check.C) {
testRequires(c, SameHostDaemon, seccompEnabled, NotArm, NotPpc64le, NotS390X)
testRequires(c, SameHostDaemon, seccompEnabled)
out, _, err := dockerCmdWithError("run", "--security-opt", "seccomp=../profiles/seccomp/default.json", "debian:jessie", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami")
c.Assert(err, checker.NotNil, check.Commentf(out))
@ -1259,3 +1259,94 @@ func (s *DockerSuite) TestRunUserDeviceAllowed(c *check.C) {
out, _ := dockerCmd(c, "run", "--device", "/dev/snd/timer:w", "busybox", "cat", file)
c.Assert(out, checker.Contains, fmt.Sprintf("c %d:%d w", stat.Rdev/256, stat.Rdev%256))
}
func (s *DockerDaemonSuite) TestRunSeccompJSONNewFormat(c *check.C) {
testRequires(c, SameHostDaemon, seccompEnabled)
err := s.d.StartWithBusybox()
c.Assert(err, check.IsNil)
jsonData := `{
"defaultAction": "SCMP_ACT_ALLOW",
"syscalls": [
{
"names": ["chmod", "fchmod", "fchmodat"],
"action": "SCMP_ACT_ERRNO"
}
]
}`
tmpFile, err := ioutil.TempFile("", "profile.json")
c.Assert(err, check.IsNil)
defer tmpFile.Close()
_, err = tmpFile.Write([]byte(jsonData))
c.Assert(err, check.IsNil)
out, err := s.d.Cmd("run", "--security-opt", "seccomp="+tmpFile.Name(), "busybox", "chmod", "777", ".")
c.Assert(err, check.NotNil)
c.Assert(out, checker.Contains, "Operation not permitted")
}
func (s *DockerDaemonSuite) TestRunSeccompJSONNoNameAndNames(c *check.C) {
testRequires(c, SameHostDaemon, seccompEnabled)
err := s.d.StartWithBusybox()
c.Assert(err, check.IsNil)
jsonData := `{
"defaultAction": "SCMP_ACT_ALLOW",
"syscalls": [
{
"name": "chmod",
"names": ["fchmod", "fchmodat"],
"action": "SCMP_ACT_ERRNO"
}
]
}`
tmpFile, err := ioutil.TempFile("", "profile.json")
c.Assert(err, check.IsNil)
defer tmpFile.Close()
_, err = tmpFile.Write([]byte(jsonData))
c.Assert(err, check.IsNil)
out, err := s.d.Cmd("run", "--security-opt", "seccomp="+tmpFile.Name(), "busybox", "chmod", "777", ".")
c.Assert(err, check.NotNil)
c.Assert(out, checker.Contains, "'name' and 'names' were specified in the seccomp profile, use either 'name' or 'names'")
}
func (s *DockerDaemonSuite) TestRunSeccompJSONNoArchAndArchMap(c *check.C) {
testRequires(c, SameHostDaemon, seccompEnabled)
err := s.d.StartWithBusybox()
c.Assert(err, check.IsNil)
jsonData := `{
"archMap": [
{
"architecture": "SCMP_ARCH_X86_64",
"subArchitectures": [
"SCMP_ARCH_X86",
"SCMP_ARCH_X32"
]
}
],
"architectures": [
"SCMP_ARCH_X32"
],
"defaultAction": "SCMP_ACT_ALLOW",
"syscalls": [
{
"names": ["chmod", "fchmod", "fchmodat"],
"action": "SCMP_ACT_ERRNO"
}
]
}`
tmpFile, err := ioutil.TempFile("", "profile.json")
c.Assert(err, check.IsNil)
defer tmpFile.Close()
_, err = tmpFile.Write([]byte(jsonData))
c.Assert(err, check.IsNil)
out, err := s.d.Cmd("run", "--security-opt", "seccomp="+tmpFile.Name(), "busybox", "chmod", "777", ".")
c.Assert(err, check.NotNil)
c.Assert(out, checker.Contains, "'architectures' and 'archMap' were specified in the seccomp profile, use either 'architectures' or 'archMap'")
}

2201
profiles/seccomp/default.json
View file

File diff suppressed because it is too large Load diff

5
profiles/seccomp/generate.go
View file

@ -8,7 +8,6 @@ import (
"os"
"path/filepath"
"github.com/docker/docker/oci"
"github.com/docker/docker/profiles/seccomp"
)
@ -21,10 +20,8 @@ func main() {
}
f := filepath.Join(wd, "default.json")
rs := oci.DefaultSpec()
// write the default profile to the file
b, err := json.MarshalIndent(seccomp.DefaultProfile(&rs), "", "\t")
b, err := json.MarshalIndent(seccomp.DefaultProfile(), "", "\t")
if err != nil {
panic(err)
}

126
profiles/seccomp/seccomp.go
View file

@ -4,30 +4,42 @@ package seccomp
import (
"encoding/json"
"errors"
"fmt"
"github.com/docker/docker/pkg/stringutils"
"github.com/docker/engine-api/types"
"github.com/opencontainers/runtime-spec/specs-go"
libseccomp "github.com/seccomp/libseccomp-golang"
)
//go:generate go run -tags 'seccomp' generate.go
// GetDefaultProfile returns the default seccomp profile.
func GetDefaultProfile(rs *specs.Spec) (*specs.Seccomp, error) {
return setupSeccomp(DefaultProfile(rs))
return setupSeccomp(DefaultProfile(), rs)
}
// LoadProfile takes a file path and decodes the seccomp profile.
func LoadProfile(body string) (*specs.Seccomp, error) {
func LoadProfile(body string, rs *specs.Spec) (*specs.Seccomp, error) {
var config types.Seccomp
if err := json.Unmarshal([]byte(body), &config); err != nil {
return nil, fmt.Errorf("Decoding seccomp profile failed: %v", err)
}
return setupSeccomp(&config)
return setupSeccomp(&config, rs)
}
func setupSeccomp(config *types.Seccomp) (newConfig *specs.Seccomp, err error) {
var nativeToSeccomp = map[string]types.Arch{
"amd64": types.ArchX86_64,
"arm64": types.ArchAARCH64,
"mips64": types.ArchMIPS64,
"mips64n32": types.ArchMIPS64N32,
"mipsel64": types.ArchMIPSEL64,
"mipsel64n32": types.ArchMIPSEL64N32,
"s390x": types.ArchS390X,
}
func setupSeccomp(config *types.Seccomp, rs *specs.Spec) (*specs.Seccomp, error) {
if config == nil {
return nil, nil
}
@ -37,38 +49,102 @@ func setupSeccomp(config *types.Seccomp) (newConfig *specs.Seccomp, err error) {
return nil, nil
}
newConfig = &specs.Seccomp{}
newConfig := &specs.Seccomp{}
var arch string
var native, err = libseccomp.GetNativeArch()
if err == nil {
arch = native.String()
}
if len(config.Architectures) != 0 && len(config.ArchMap) != 0 {
return nil, errors.New("'architectures' and 'archMap' were specified in the seccomp profile, use either 'architectures' or 'archMap'")
}
// if config.Architectures == 0 then libseccomp will figure out the architecture to use
if len(config.Architectures) > 0 {
for _, arch := range config.Architectures {
newConfig.Architectures = append(newConfig.Architectures, specs.Arch(arch))
if len(config.Architectures) != 0 {
for _, a := range config.Architectures {
newConfig.Architectures = append(newConfig.Architectures, specs.Arch(a))
}
}
if len(config.ArchMap) != 0 {
for _, a := range config.ArchMap {
seccompArch, ok := nativeToSeccomp[arch]
if ok {
if a.Arch == seccompArch {
newConfig.Architectures = append(newConfig.Architectures, specs.Arch(a.Arch))
for _, sa := range a.SubArches {
newConfig.Architectures = append(newConfig.Architectures, specs.Arch(sa))
}
break
}
}
}
}
newConfig.DefaultAction = specs.Action(config.DefaultAction)
// Loop through all syscall blocks and convert them to libcontainer format
Loop:
// Loop through all syscall blocks and convert them to libcontainer format after filtering them
for _, call := range config.Syscalls {
newCall := specs.Syscall{
Name: call.Name,
Action: specs.Action(call.Action),
}
// Loop through all the arguments of the syscall and convert them
for _, arg := range call.Args {
newArg := specs.Arg{
Index: arg.Index,
Value: arg.Value,
ValueTwo: arg.ValueTwo,
Op: specs.Operator(arg.Op),
if len(call.Excludes.Arches) > 0 {
if stringutils.InSlice(call.Excludes.Arches, arch) {
continue Loop
}
}
if len(call.Excludes.Caps) > 0 {
for _, c := range call.Excludes.Caps {
if stringutils.InSlice(rs.Process.Capabilities, c) {
continue Loop
}
}
}
if len(call.Includes.Arches) > 0 {
if !stringutils.InSlice(call.Includes.Arches, arch) {
continue Loop
}
}
if len(call.Includes.Caps) > 0 {
for _, c := range call.Includes.Caps {
if !stringutils.InSlice(rs.Process.Capabilities, c) {
continue Loop
}
}
newCall.Args = append(newCall.Args, newArg)
}
newConfig.Syscalls = append(newConfig.Syscalls, newCall)
if call.Name != "" && len(call.Names) != 0 {
return nil, errors.New("'name' and 'names' were specified in the seccomp profile, use either 'name' or 'names'")
}
if call.Name != "" {
newConfig.Syscalls = append(newConfig.Syscalls, createSpecsSyscall(call.Name, call.Action, call.Args))
}
for _, n := range call.Names {
newConfig.Syscalls = append(newConfig.Syscalls, createSpecsSyscall(n, call.Action, call.Args))
}
}
return newConfig, nil
}
func createSpecsSyscall(name string, action types.Action, args []*types.Arg) specs.Syscall {
newCall := specs.Syscall{
Name: name,
Action: specs.Action(action),
}
// Loop through all the arguments of the syscall and convert them
for _, arg := range args {
newArg := specs.Arg{
Index: arg.Index,
Value: arg.Value,
ValueTwo: arg.ValueTwo,
Op: specs.Operator(arg.Op),
}
newCall.Args = append(newCall.Args, newArg)
}
return newCall
}

2353
profiles/seccomp/seccomp_default.go
View file

File diff suppressed because it is too large Load diff

8
profiles/seccomp/seccomp_test.go
View file

@ -5,6 +5,8 @@ package seccomp
import (
"io/ioutil"
"testing"
"github.com/docker/docker/oci"
)
func TestLoadProfile(t *testing.T) {
@ -12,7 +14,8 @@ func TestLoadProfile(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if _, err := LoadProfile(string(f)); err != nil {
rs := oci.DefaultSpec()
if _, err := LoadProfile(string(f), &rs); err != nil {
t.Fatal(err)
}
}
@ -22,7 +25,8 @@ func TestLoadDefaultProfile(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if _, err := LoadProfile(string(f)); err != nil {
rs := oci.DefaultSpec()
if _, err := LoadProfile(string(f), &rs); err != nil {
t.Fatal(err)
}
}