mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
Add ability to use seccomp filter for container
This commit is contained in:
parent
6df08e55b7
commit
7ebe4a999d
@ -249,6 +249,19 @@ func start() (*runner.Result, error) {
|
||||
if showDetails {
|
||||
actionDefault = seccomp.ActionTrace.WithReturnCode(seccomp.MsgDisallow)
|
||||
}
|
||||
if runt != "ptrace" {
|
||||
allow = append(allow, trace...)
|
||||
trace = nil
|
||||
}
|
||||
builder := libseccomp.Builder{
|
||||
Allow: allow,
|
||||
Trace: trace,
|
||||
Default: actionDefault,
|
||||
}
|
||||
filter, err := builder.Build()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to create seccomp filter %v", err)
|
||||
}
|
||||
|
||||
limit := runner.Limit{
|
||||
TimeLimit: time.Duration(timeLimit) * time.Second,
|
||||
@ -296,18 +309,11 @@ func start() (*runner.Result, error) {
|
||||
Files: fds,
|
||||
ExecFile: execFile,
|
||||
RLimits: rlims.PrepareRLimit(),
|
||||
Seccomp: filter,
|
||||
SyncFunc: syncFunc,
|
||||
},
|
||||
}
|
||||
} else if runt == "ns" {
|
||||
builder := libseccomp.Builder{
|
||||
Allow: append(allow, trace...),
|
||||
Default: actionDefault,
|
||||
}
|
||||
filter, err := builder.Build()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot build seccomp filter %v", err)
|
||||
}
|
||||
root, err := ioutil.TempDir("", "ns")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot make temp root for new namespace")
|
||||
@ -330,15 +336,6 @@ func start() (*runner.Result, error) {
|
||||
DomainName: "run_program",
|
||||
}
|
||||
} else if runt == "ptrace" {
|
||||
builder := libseccomp.Builder{
|
||||
Allow: allow,
|
||||
Trace: trace,
|
||||
Default: actionDefault,
|
||||
}
|
||||
filter, err := builder.Build()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to create seccomp filter %v", err)
|
||||
}
|
||||
r = &ptrace.Runner{
|
||||
Args: args,
|
||||
Env: []string{pathEnv},
|
||||
|
||||
@ -65,6 +65,11 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg *unixsocket.Msg) error
|
||||
}
|
||||
}
|
||||
|
||||
var seccomp *syscall.SockFprog
|
||||
if cmd.Seccomp != nil {
|
||||
seccomp = cmd.Seccomp.SockFprog()
|
||||
}
|
||||
|
||||
r := forkexec.Runner{
|
||||
Args: cmd.Argv,
|
||||
Env: cmd.Env,
|
||||
@ -77,6 +82,7 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg *unixsocket.Msg) error
|
||||
SyncFunc: syncFunc,
|
||||
Credential: cred,
|
||||
CTTY: cmd.CTTY,
|
||||
Seccomp: seccomp,
|
||||
|
||||
UnshareCgroupAfterSync: true,
|
||||
}
|
||||
|
||||
@ -6,6 +6,7 @@ import (
|
||||
"time"
|
||||
|
||||
"github.com/criyle/go-sandbox/pkg/rlimit"
|
||||
"github.com/criyle/go-sandbox/pkg/seccomp"
|
||||
"github.com/criyle/go-sandbox/pkg/unixsocket"
|
||||
"github.com/criyle/go-sandbox/runner"
|
||||
)
|
||||
@ -27,6 +28,9 @@ type ExecveParam struct {
|
||||
// RLimits specifies POSIX Resource limit through setrlimit
|
||||
RLimits []rlimit.RLimit
|
||||
|
||||
// Seccomp specifies seccomp filter
|
||||
Seccomp seccomp.Filter
|
||||
|
||||
// CTTY specifies whether to set controlling TTY
|
||||
CTTY bool
|
||||
|
||||
@ -64,6 +68,7 @@ func (c *container) Execve(ctx context.Context, param ExecveParam) <-chan runner
|
||||
Argv: param.Args,
|
||||
Env: param.Env,
|
||||
RLimits: param.RLimits,
|
||||
Seccomp: param.Seccomp,
|
||||
FdExec: param.ExecFile > 0,
|
||||
CTTY: param.CTTY,
|
||||
}
|
||||
|
||||
@ -7,6 +7,7 @@ import (
|
||||
|
||||
"github.com/criyle/go-sandbox/pkg/mount"
|
||||
"github.com/criyle/go-sandbox/pkg/rlimit"
|
||||
"github.com/criyle/go-sandbox/pkg/seccomp"
|
||||
"github.com/criyle/go-sandbox/runner"
|
||||
)
|
||||
|
||||
@ -37,6 +38,7 @@ type execCmd struct {
|
||||
Argv []string // execve argv
|
||||
Env []string // execve env
|
||||
RLimits []rlimit.RLimit // execve posix rlimit
|
||||
Seccomp seccomp.Filter // seccomp filter
|
||||
FdExec bool // if use fexecve (fd[0] as exec)
|
||||
CTTY bool // if set CTTY
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user