mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
97535c6c2b
This removes the dependency on the `pkg/parsers/kernel` package, because secomp only needs to consider Linux (and no parsing is needed for Windows or Darwin kernel versions). This patch implements the minimum requirements for this implementation: - only `kernel` and `major` versions are considered - `minor` version, `flavor`, and `-rcXX` suffixes are ignored So, for example: - `3.4.54.longterm-1` => `kernel: 3`, `major: 4` - `3.8.0-19-generic` => `kernel: 3`, `major: 8` - `3.10.0-862.2.3.el7.x86_64` => `kernel: 3`, `major: 10` Some systems also omit the `minor` and/or have odd-formatted versions. In context of generating seccomp profiles, both versions below are considered equal; - `3.12.25-gentoo` => `kernel: 3`, `major: 12` - `3.12-1-amd64` => `kernel: 3`, `major: 12` Note that `-rcX` suffixes are also not considered, and thus (e.g.) kernel `5.9-rc1`, `5.9-rc6` and `5.9` are all considered equal. The motivation for ignoring "minor" versions and "flavors" is that; - The upstream kernel only does "kernel.major" releases - While release-candidates exists for kernel (e.g. 5.9-rc5), we don't expect users to write profiles that target a specific release-candidate, and therefore consider (e.g.) kernel `5.9-rc1`, `5.9-rc6` and `5.9` to be equal. - Generally, a seccomp-profile should either be portable, or written for a specific infrastructure (in which case the writer of the profile would know if the kernel-flavors used does/does not support certain things. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
69 lines
2 KiB
Go
69 lines
2 KiB
Go
package seccomp
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"sync"
|
|
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
// kernelVersion holds information about the kernel.
|
|
type kernelVersion struct {
|
|
kernel uint // Version of the kernel (i.e., the "4" in "4.1.2-generic")
|
|
major uint // Major revision of the kernel (i.e., the "1" in "4.1.2-generic")
|
|
}
|
|
|
|
var (
|
|
currentKernelVersion *kernelVersion
|
|
kernelVersionError error
|
|
once sync.Once
|
|
)
|
|
|
|
// getKernelVersion gets the current kernel version.
|
|
func getKernelVersion() (*kernelVersion, error) {
|
|
once.Do(func() {
|
|
var uts unix.Utsname
|
|
if err := unix.Uname(&uts); err != nil {
|
|
return
|
|
}
|
|
// Remove the \x00 from the release for Atoi to parse correctly
|
|
currentKernelVersion, kernelVersionError = parseRelease(string(uts.Release[:bytes.IndexByte(uts.Release[:], 0)]))
|
|
})
|
|
return currentKernelVersion, kernelVersionError
|
|
}
|
|
|
|
// parseRelease parses a string and creates a kernelVersion based on it.
|
|
func parseRelease(release string) (*kernelVersion, error) {
|
|
var version = kernelVersion{}
|
|
|
|
// We're only make sure we get the "kernel" and "major revision". Sometimes we have
|
|
// 3.12.25-gentoo, but sometimes we just have 3.12-1-amd64.
|
|
_, err := fmt.Sscanf(release, "%d.%d", &version.kernel, &version.major)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to parse kernel version %q: %w", release, err)
|
|
}
|
|
return &version, nil
|
|
}
|
|
|
|
// kernelGreaterEqualThan checks if the host's kernel version is greater than, or
|
|
// equal to the given kernel version v. Only "kernel version" and "major revision"
|
|
// can be specified (e.g., "3.12") and will be taken into account, which means
|
|
// that 3.12.25-gentoo and 3.12-1-amd64 are considered equal (kernel: 3, major: 12).
|
|
func kernelGreaterEqualThan(v string) (bool, error) {
|
|
minVersion, err := parseRelease(v)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
kv, err := getKernelVersion()
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
if kv.kernel > minVersion.kernel {
|
|
return true, nil
|
|
}
|
|
if kv.kernel == minVersion.kernel && kv.major >= minVersion.major {
|
|
return true, nil
|
|
}
|
|
return false, nil
|
|
}
|