Add ability to use seccomp filter for container

This commit is contained in:
criyle 2020-12-12 12:16:28 -08:00
parent 6df08e55b7
commit 7ebe4a999d
4 changed files with 27 additions and 17 deletions

View File

@ -249,6 +249,19 @@ func start() (*runner.Result, error) {
if showDetails {
actionDefault = seccomp.ActionTrace.WithReturnCode(seccomp.MsgDisallow)
}
if runt != "ptrace" {
allow = append(allow, trace...)
trace = nil
}
builder := libseccomp.Builder{
Allow: allow,
Trace: trace,
Default: actionDefault,
}
filter, err := builder.Build()
if err != nil {
return nil, fmt.Errorf("failed to create seccomp filter %v", err)
}
limit := runner.Limit{
TimeLimit: time.Duration(timeLimit) * time.Second,
@ -296,18 +309,11 @@ func start() (*runner.Result, error) {
Files: fds,
ExecFile: execFile,
RLimits: rlims.PrepareRLimit(),
Seccomp: filter,
SyncFunc: syncFunc,
},
}
} else if runt == "ns" {
builder := libseccomp.Builder{
Allow: append(allow, trace...),
Default: actionDefault,
}
filter, err := builder.Build()
if err != nil {
return nil, fmt.Errorf("cannot build seccomp filter %v", err)
}
root, err := ioutil.TempDir("", "ns")
if err != nil {
return nil, fmt.Errorf("cannot make temp root for new namespace")
@ -330,15 +336,6 @@ func start() (*runner.Result, error) {
DomainName: "run_program",
}
} else if runt == "ptrace" {
builder := libseccomp.Builder{
Allow: allow,
Trace: trace,
Default: actionDefault,
}
filter, err := builder.Build()
if err != nil {
return nil, fmt.Errorf("failed to create seccomp filter %v", err)
}
r = &ptrace.Runner{
Args: args,
Env: []string{pathEnv},

View File

@ -65,6 +65,11 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg *unixsocket.Msg) error
}
}
var seccomp *syscall.SockFprog
if cmd.Seccomp != nil {
seccomp = cmd.Seccomp.SockFprog()
}
r := forkexec.Runner{
Args: cmd.Argv,
Env: cmd.Env,
@ -77,6 +82,7 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg *unixsocket.Msg) error
SyncFunc: syncFunc,
Credential: cred,
CTTY: cmd.CTTY,
Seccomp: seccomp,
UnshareCgroupAfterSync: true,
}

View File

@ -6,6 +6,7 @@ import (
"time"
"github.com/criyle/go-sandbox/pkg/rlimit"
"github.com/criyle/go-sandbox/pkg/seccomp"
"github.com/criyle/go-sandbox/pkg/unixsocket"
"github.com/criyle/go-sandbox/runner"
)
@ -27,6 +28,9 @@ type ExecveParam struct {
// RLimits specifies POSIX Resource limit through setrlimit
RLimits []rlimit.RLimit
// Seccomp specifies seccomp filter
Seccomp seccomp.Filter
// CTTY specifies whether to set controlling TTY
CTTY bool
@ -64,6 +68,7 @@ func (c *container) Execve(ctx context.Context, param ExecveParam) <-chan runner
Argv: param.Args,
Env: param.Env,
RLimits: param.RLimits,
Seccomp: param.Seccomp,
FdExec: param.ExecFile > 0,
CTTY: param.CTTY,
}

View File

@ -7,6 +7,7 @@ import (
"github.com/criyle/go-sandbox/pkg/mount"
"github.com/criyle/go-sandbox/pkg/rlimit"
"github.com/criyle/go-sandbox/pkg/seccomp"
"github.com/criyle/go-sandbox/runner"
)
@ -37,6 +38,7 @@ type execCmd struct {
Argv []string // execve argv
Env []string // execve env
RLimits []rlimit.RLimit // execve posix rlimit
Seccomp seccomp.Filter // seccomp filter
FdExec bool // if use fexecve (fd[0] as exec)
CTTY bool // if set CTTY
}