package seccomp // import "github.com/docker/docker/profiles/seccomp" import ( "encoding/json" "fmt" "strconv" "strings" "github.com/opencontainers/runtime-spec/specs-go" ) // Seccomp represents the config for a seccomp profile for syscall restriction. // It is used to marshal/unmarshal the JSON profiles as accepted by docker, and // extends the runtime-spec's specs.LinuxSeccomp, overriding some fields to // provide the ability to define conditional rules based on the host's kernel // version, architecture, and the container's capabilities. type Seccomp struct { specs.LinuxSeccomp // ArchMap contains a list of Architectures and Sub-architectures for the // profile. When generating the profile, this list is expanded to a // []specs.Arch, to propagate the Architectures field of the profile. ArchMap []Architecture `json:"archMap,omitempty"` // Syscalls contains lists of syscall rules. Rules can define conditions // for them to be included or excluded in the resulting profile (based on // on kernel version, architecture, capabilities, etc.). These lists are // expanded to an specs.Syscall When generating the profile, these lists // are expanded to a []specs.LinuxSyscall. Syscalls []*Syscall `json:"syscalls"` } // Architecture is used to represent a specific architecture // and its sub-architectures type Architecture struct { Arch specs.Arch `json:"architecture"` SubArches []specs.Arch `json:"subArchitectures"` } // Filter is used to conditionally apply Seccomp rules type Filter struct { Caps []string `json:"caps,omitempty"` Arches []string `json:"arches,omitempty"` // MinKernel describes the minimum kernel version the rule must be applied // on, in the format "." (e.g. "3.12"). // // When matching the kernel version of the host, minor revisions, and distro- // specific suffixes are ignored, which means that "3.12.25-gentoo", "3.12-1-amd64", // "3.12", and "3.12-rc5" are considered equal (kernel 3, major revision 12). MinKernel *KernelVersion `json:"minKernel,omitempty"` } // Syscall is used to match a group of syscalls in Seccomp. It extends the // runtime-spec Syscall type, adding a "Name" field for backward compatibility // with older JSON representations, additional "Comment" metadata, and conditional // rules ("Includes", "Excludes") used to generate a runtime-spec Seccomp profile // based on the container (capabilities) and host's (arch, kernel) configuration. type Syscall struct { specs.LinuxSyscall // Deprecated: kept for backward compatibility with old JSON profiles, use Names instead Name string `json:"name,omitempty"` Comment string `json:"comment,omitempty"` Includes *Filter `json:"includes,omitempty"` Excludes *Filter `json:"excludes,omitempty"` } // KernelVersion holds information about the kernel. type KernelVersion struct { Kernel uint64 // Version of the Kernel (i.e., the "4" in "4.1.2-generic") Major uint64 // Major revision of the Kernel (i.e., the "1" in "4.1.2-generic") } // String implements fmt.Stringer for KernelVersion func (k *KernelVersion) String() string { if k.Kernel > 0 || k.Major > 0 { return fmt.Sprintf("%d.%d", k.Kernel, k.Major) } return "" } // MarshalJSON implements json.Unmarshaler for KernelVersion func (k *KernelVersion) MarshalJSON() ([]byte, error) { return json.Marshal(k.String()) } // UnmarshalJSON implements json.Marshaler for KernelVersion func (k *KernelVersion) UnmarshalJSON(version []byte) error { var ( ver string err error ) // make sure we have a string if err = json.Unmarshal(version, &ver); err != nil { return fmt.Errorf(`invalid kernel version: %s, expected ".": %v`, string(version), err) } if ver == "" { return nil } parts := strings.SplitN(ver, ".", 3) if len(parts) != 2 { return fmt.Errorf(`invalid kernel version: %s, expected "."`, string(version)) } if k.Kernel, err = strconv.ParseUint(parts[0], 10, 8); err != nil { return fmt.Errorf(`invalid kernel version: %s, expected ".": %v`, string(version), err) } if k.Major, err = strconv.ParseUint(parts[1], 10, 8); err != nil { return fmt.Errorf(`invalid kernel version: %s, expected ".": %v`, string(version), err) } if k.Kernel == 0 && k.Major == 0 { return fmt.Errorf(`invalid kernel version: %s, expected ".": version cannot be 0.0`, string(version)) } return nil }