diff --git a/cmd/runprog/main_linux.go b/cmd/runprog/main_linux.go index 4b6e84b..acebd8d 100644 --- a/cmd/runprog/main_linux.go +++ b/cmd/runprog/main_linux.go @@ -249,6 +249,19 @@ func start() (*runner.Result, error) { if showDetails { actionDefault = seccomp.ActionTrace.WithReturnCode(seccomp.MsgDisallow) } + if runt != "ptrace" { + allow = append(allow, trace...) + trace = nil + } + builder := libseccomp.Builder{ + Allow: allow, + Trace: trace, + Default: actionDefault, + } + filter, err := builder.Build() + if err != nil { + return nil, fmt.Errorf("failed to create seccomp filter %v", err) + } limit := runner.Limit{ TimeLimit: time.Duration(timeLimit) * time.Second, @@ -296,18 +309,11 @@ func start() (*runner.Result, error) { Files: fds, ExecFile: execFile, RLimits: rlims.PrepareRLimit(), + Seccomp: filter, SyncFunc: syncFunc, }, } } else if runt == "ns" { - builder := libseccomp.Builder{ - Allow: append(allow, trace...), - Default: actionDefault, - } - filter, err := builder.Build() - if err != nil { - return nil, fmt.Errorf("cannot build seccomp filter %v", err) - } root, err := ioutil.TempDir("", "ns") if err != nil { return nil, fmt.Errorf("cannot make temp root for new namespace") @@ -330,15 +336,6 @@ func start() (*runner.Result, error) { DomainName: "run_program", } } else if runt == "ptrace" { - builder := libseccomp.Builder{ - Allow: allow, - Trace: trace, - Default: actionDefault, - } - filter, err := builder.Build() - if err != nil { - return nil, fmt.Errorf("failed to create seccomp filter %v", err) - } r = &ptrace.Runner{ Args: args, Env: []string{pathEnv}, diff --git a/container/container_exec_linux.go b/container/container_exec_linux.go index d9a349a..825b441 100644 --- a/container/container_exec_linux.go +++ b/container/container_exec_linux.go @@ -65,6 +65,11 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg *unixsocket.Msg) error } } + var seccomp *syscall.SockFprog + if cmd.Seccomp != nil { + seccomp = cmd.Seccomp.SockFprog() + } + r := forkexec.Runner{ Args: cmd.Argv, Env: cmd.Env, @@ -77,6 +82,7 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg *unixsocket.Msg) error SyncFunc: syncFunc, Credential: cred, CTTY: cmd.CTTY, + Seccomp: seccomp, UnshareCgroupAfterSync: true, } diff --git a/container/host_exec_linux.go b/container/host_exec_linux.go index 8c00358..4755174 100644 --- a/container/host_exec_linux.go +++ b/container/host_exec_linux.go @@ -6,6 +6,7 @@ import ( "time" "github.com/criyle/go-sandbox/pkg/rlimit" + "github.com/criyle/go-sandbox/pkg/seccomp" "github.com/criyle/go-sandbox/pkg/unixsocket" "github.com/criyle/go-sandbox/runner" ) @@ -27,6 +28,9 @@ type ExecveParam struct { // RLimits specifies POSIX Resource limit through setrlimit RLimits []rlimit.RLimit + // Seccomp specifies seccomp filter + Seccomp seccomp.Filter + // CTTY specifies whether to set controlling TTY CTTY bool @@ -64,6 +68,7 @@ func (c *container) Execve(ctx context.Context, param ExecveParam) <-chan runner Argv: param.Args, Env: param.Env, RLimits: param.RLimits, + Seccomp: param.Seccomp, FdExec: param.ExecFile > 0, CTTY: param.CTTY, } diff --git a/container/protocol_linux.go b/container/protocol_linux.go index 9ed886e..b1857b2 100644 --- a/container/protocol_linux.go +++ b/container/protocol_linux.go @@ -7,6 +7,7 @@ import ( "github.com/criyle/go-sandbox/pkg/mount" "github.com/criyle/go-sandbox/pkg/rlimit" + "github.com/criyle/go-sandbox/pkg/seccomp" "github.com/criyle/go-sandbox/runner" ) @@ -37,6 +38,7 @@ type execCmd struct { Argv []string // execve argv Env []string // execve env RLimits []rlimit.RLimit // execve posix rlimit + Seccomp seccomp.Filter // seccomp filter FdExec bool // if use fexecve (fd[0] as exec) CTTY bool // if set CTTY }