kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Add const for "unconfined" and default seccomp profiles

Browse source 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn 2021-06-07 13:44:32 +02:00
parent 5e498e20f7
commit ee02257553
No known key found for this signature in database
GPG key ID: 76698F39D527CE8C
6 changed files with 16 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
daemon/config/config.go
View file

@ -58,6 +58,12 @@ const (
LinuxV1RuntimeName = "io.containerd.runtime.v1.linux"
// LinuxV2RuntimeName is the runtime used to specify the containerd v2 runc shim
LinuxV2RuntimeName = "io.containerd.runc.v2"
// SeccompProfileDefault is the built-in default seccomp profile.
SeccompProfileDefault = "default"
// SeccompProfileUnconfined is a special profile name for seccomp to use an
// "unconfined" seccomp profile.
SeccompProfileUnconfined = "unconfined"
)
var builtinRuntimes = map[string]bool{

2
daemon/info.go
View file

@ -174,7 +174,7 @@ func (daemon *Daemon) fillSecurityOptions(v *types.Info, sysInfo *sysinfo.SysInf
if sysInfo.Seccomp && supportsSeccomp {
profile := daemon.seccompProfilePath
if profile == "" {
profile = "default"
profile = config.SeccompProfileDefault
}
securityOptions = append(securityOptions, fmt.Sprintf("name=seccomp,profile=%s", profile))
}

3
daemon/seccomp_disabled.go
View file

@ -9,6 +9,7 @@ import (
"github.com/containerd/containerd/containers"
coci "github.com/containerd/containerd/oci"
"github.com/docker/docker/container"
dconfig "github.com/docker/docker/daemon/config"
)
const supportsSeccomp = false
@ -16,7 +17,7 @@ const supportsSeccomp = false
// WithSeccomp sets the seccomp profile
func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {
return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
if c.SeccompProfile != "" && c.SeccompProfile != "unconfined" {
if c.SeccompProfile != "" && c.SeccompProfile != dconfig.SeccompProfileUnconfined {
return fmt.Errorf("seccomp profiles are not supported on this daemon, you cannot specify a custom seccomp profile")
}
return nil

5
daemon/seccomp_linux.go
View file

@ -9,6 +9,7 @@ import (
"github.com/containerd/containerd/containers"
coci "github.com/containerd/containerd/oci"
"github.com/docker/docker/container"
dconfig "github.com/docker/docker/daemon/config"
"github.com/docker/docker/profiles/seccomp"
"github.com/sirupsen/logrus"
)
@ -18,7 +19,7 @@ const supportsSeccomp = true
// WithSeccomp sets the seccomp profile
func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {
return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
if c.SeccompProfile == "unconfined" {
if c.SeccompProfile == dconfig.SeccompProfileUnconfined {
return nil
}
if c.HostConfig.Privileged {
@ -29,7 +30,7 @@ func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {
return fmt.Errorf("seccomp is not enabled in your kernel, cannot run a custom seccomp profile")
}
logrus.Warn("seccomp is not enabled in your kernel, running container without default profile")
c.SeccompProfile = "unconfined"
c.SeccompProfile = dconfig.SeccompProfileUnconfined
return nil
}
var err error

3
daemon/seccomp_linux_test.go
View file

@ -8,6 +8,7 @@ import (
coci "github.com/containerd/containerd/oci"
config "github.com/docker/docker/api/types/container"
"github.com/docker/docker/container"
dconfig "github.com/docker/docker/daemon/config"
doci "github.com/docker/docker/oci"
"github.com/docker/docker/profiles/seccomp"
specs "github.com/opencontainers/runtime-spec/specs-go"
@ -32,7 +33,7 @@ func TestWithSeccomp(t *testing.T) {
seccompEnabled: true,
},
c: &container.Container{
SeccompProfile: "unconfined",
SeccompProfile: dconfig.SeccompProfileUnconfined,
HostConfig: &config.HostConfig{
Privileged: false,
},

3
integration-cli/docker_cli_info_unix_test.go
View file

@ -7,6 +7,7 @@ import (
"testing"
"github.com/docker/docker/client"
"github.com/docker/docker/daemon/config"
"gotest.tools/v3/assert"
is "gotest.tools/v3/assert/cmp"
)
@ -27,6 +28,6 @@ func (s *DockerSuite) TestInfoSecurityOptions(c *testing.T) {
assert.Check(c, is.Contains(info.SecurityOptions, "name=apparmor"))
}
if seccompEnabled() {
assert.Check(c, is.Contains(info.SecurityOptions, "name=seccomp,profile=default"))
assert.Check(c, is.Contains(info.SecurityOptions, "name=seccomp,profile="+config.SeccompProfileDefault))
}
}