github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-06-25 15:02:45 +00:00
Code Issues Projects Releases Wiki Activity

agent: "Revert agent: Disable seccomp feature on aarch64 temporarily"

Browse Source 
Re-enable seccomp feature on aarch64 because CI is ready
by https://github.com/kata-containers/tests/pull/4124.

This reverts commit 42add7f201.

Fixes: #2939

Signed-off-by: Manabu Sugimoto <Manabu.Sugimoto@sony.com>
This commit is contained in:
Manabu Sugimoto 2021-11-01 22:47:39 +09:00
parent 1c81d7e0b6
commit 1aaa0599d9
3 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/agent/rustjail/Cargo.toml
View File

@ -30,9 +30,6 @@ tokio = { version = "1.2.0", features = ["sync", "io-util", "process", "time", "
futures = "0.3" futures = "0.3"
async-trait = "0.1.31" async-trait = "0.1.31"
inotify = "0.9.2" inotify = "0.9.2"
# Disable libseccomp on aarch64 temporarily in order to pass CI
[target.'cfg(not(target_arch = "aarch64"))'.dependencies]
libseccomp = { version = "0.1.3", optional = true } libseccomp = { version = "0.1.3", optional = true }
[dev-dependencies] [dev-dependencies]

6
src/agent/rustjail/src/container.rs
View File

@ -25,7 +25,7 @@ use crate::cgroups::mock::Manager as FsManager;
use crate::cgroups::Manager; use crate::cgroups::Manager;
use crate::log_child; use crate::log_child;
use crate::process::Process; use crate::process::Process;
#[cfg(all(not(target_arch = "aarch64"), feature = "seccomp"))] #[cfg(feature = "seccomp")]
use crate::seccomp; use crate::seccomp;
use crate::specconv::CreateOpts; use crate::specconv::CreateOpts;
use crate::{mount, validator}; use crate::{mount, validator};
@ -603,7 +603,7 @@ fn do_init_child(cwfd: RawFd) -> Result<()> {
// Without NoNewPrivileges, we need to set seccomp // Without NoNewPrivileges, we need to set seccomp
// before dropping capabilities because the calling thread // before dropping capabilities because the calling thread
// must have the CAP_SYS_ADMIN. // must have the CAP_SYS_ADMIN.
#[cfg(all(not(target_arch = "aarch64"), feature = "seccomp"))] #[cfg(feature = "seccomp")]
if !oci_process.no_new_privileges { if !oci_process.no_new_privileges {
if let Some(ref scmp) = linux.seccomp { if let Some(ref scmp) = linux.seccomp {
seccomp::init_seccomp(scmp)?; seccomp::init_seccomp(scmp)?;
@ -685,7 +685,7 @@ fn do_init_child(cwfd: RawFd) -> Result<()> {
// With NoNewPrivileges, we should set seccomp as close to // With NoNewPrivileges, we should set seccomp as close to
// do_exec as possible in order to reduce the amount of // do_exec as possible in order to reduce the amount of
// system calls in the seccomp profiles. // system calls in the seccomp profiles.
#[cfg(all(not(target_arch = "aarch64"), feature = "seccomp"))] #[cfg(feature = "seccomp")]
if oci_process.no_new_privileges { if oci_process.no_new_privileges {
if let Some(ref scmp) = linux.seccomp { if let Some(ref scmp) = linux.seccomp {
seccomp::init_seccomp(scmp)?; seccomp::init_seccomp(scmp)?;

2
src/agent/rustjail/src/lib.rs
View File

@ -34,7 +34,7 @@ pub mod container;
pub mod mount; pub mod mount;
pub mod pipestream; pub mod pipestream;
pub mod process; pub mod process;
#[cfg(all(not(target_arch = "aarch64"), feature = "seccomp"))] #[cfg(feature = "seccomp")]
pub mod seccomp; pub mod seccomp;
pub mod specconv; pub mod specconv;
pub mod sync; pub mod sync;