github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-06-27 07:48:55 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #2940 from ManaSugi/seccomp-aarch64

Browse Source 
agent: "Revert agent: Disable seccomp feature on aarch64 temporarily"
This commit is contained in:
GabyCT 2021-11-04 09:38:45 -06:00 committed by GitHub
commit 86b5bb5801
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 7 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/agent/rustjail/Cargo.toml
View File

@ -30,9 +30,6 @@ tokio = { version = "1.2.0", features = ["sync", "io-util", "process", "time", "
futures = "0.3" futures = "0.3"
async-trait = "0.1.31" async-trait = "0.1.31"
inotify = "0.9.2" inotify = "0.9.2"
# Disable libseccomp on aarch64 temporarily in order to pass CI
[target.'cfg(not(target_arch = "aarch64"))'.dependencies]
libseccomp = { version = "0.1.3", optional = true } libseccomp = { version = "0.1.3", optional = true }
[dev-dependencies] [dev-dependencies]

6
src/agent/rustjail/src/container.rs
View File

@ -25,7 +25,7 @@ use crate::cgroups::mock::Manager as FsManager;
use crate::cgroups::Manager; use crate::cgroups::Manager;
use crate::log_child; use crate::log_child;
use crate::process::Process; use crate::process::Process;
#[cfg(all(not(target_arch = "aarch64"), feature = "seccomp"))] #[cfg(feature = "seccomp")]
use crate::seccomp; use crate::seccomp;
use crate::specconv::CreateOpts; use crate::specconv::CreateOpts;
use crate::{mount, validator}; use crate::{mount, validator};
@ -603,7 +603,7 @@ fn do_init_child(cwfd: RawFd) -> Result<()> {
// Without NoNewPrivileges, we need to set seccomp // Without NoNewPrivileges, we need to set seccomp
// before dropping capabilities because the calling thread // before dropping capabilities because the calling thread
// must have the CAP_SYS_ADMIN. // must have the CAP_SYS_ADMIN.
#[cfg(all(not(target_arch = "aarch64"), feature = "seccomp"))] #[cfg(feature = "seccomp")]
if !oci_process.no_new_privileges { if !oci_process.no_new_privileges {
if let Some(ref scmp) = linux.seccomp { if let Some(ref scmp) = linux.seccomp {
seccomp::init_seccomp(scmp)?; seccomp::init_seccomp(scmp)?;
@ -685,7 +685,7 @@ fn do_init_child(cwfd: RawFd) -> Result<()> {
// With NoNewPrivileges, we should set seccomp as close to // With NoNewPrivileges, we should set seccomp as close to
// do_exec as possible in order to reduce the amount of // do_exec as possible in order to reduce the amount of
// system calls in the seccomp profiles. // system calls in the seccomp profiles.
#[cfg(all(not(target_arch = "aarch64"), feature = "seccomp"))] #[cfg(feature = "seccomp")]
if oci_process.no_new_privileges { if oci_process.no_new_privileges {
if let Some(ref scmp) = linux.seccomp { if let Some(ref scmp) = linux.seccomp {
seccomp::init_seccomp(scmp)?; seccomp::init_seccomp(scmp)?;

2
src/agent/rustjail/src/lib.rs
View File

@ -34,7 +34,7 @@ pub mod container;
pub mod mount; pub mod mount;
pub mod pipestream; pub mod pipestream;
pub mod process; pub mod process;
#[cfg(all(not(target_arch = "aarch64"), feature = "seccomp"))] #[cfg(feature = "seccomp")]
pub mod seccomp; pub mod seccomp;
pub mod specconv; pub mod specconv;
pub mod sync; pub mod sync;

6
src/agent/rustjail/src/seccomp.rs
View File

@ -95,7 +95,7 @@ pub fn init_seccomp(scmp: &LinuxSeccomp) -> Result<()> {
mod tests { mod tests {
use super::*; use super::*;
use crate::skip_if_not_root; use crate::skip_if_not_root;
use libc::{dup2, process_vm_readv, EPERM}; use libc::{dup3, process_vm_readv, EPERM, O_CLOEXEC};
use std::io::Error; use std::io::Error;
use std::ptr::null; use std::ptr::null;
@ -135,7 +135,7 @@ mod tests {
"syscalls": [ "syscalls": [
{ {
"names": [ "names": [
"dup2" "dup3"
], ],
"action": "SCMP_ACT_ERRNO" "action": "SCMP_ACT_ERRNO"
}, },
@ -212,7 +212,7 @@ mod tests {
init_seccomp(&scmp).unwrap(); init_seccomp(&scmp).unwrap();
// Basic syscall with simple rule // Basic syscall with simple rule
syscall_assert!(unsafe { dup2(0, 1) }, -EPERM); syscall_assert!(unsafe { dup3(0, 1, O_CLOEXEC) }, -EPERM);
// Syscall with permitted arguments // Syscall with permitted arguments
syscall_assert!(unsafe { process_vm_readv(1, null(), 0, null(), 0, 0) }, 0); syscall_assert!(unsafe { process_vm_readv(1, null(), 0, null(), 0, 0) }, 0);