From a3647e34865d7b2e1f16de90870775729d1f45b5 Mon Sep 17 00:00:00 2001 From: Manabu Sugimoto Date: Fri, 16 Jul 2021 15:04:33 +0900 Subject: [PATCH] osbuilder: Set up libseccomp library The osbuilder needs to set up libseccomp library to build the kata-agent because the kata-agent supports seccomp currently. The library is built from the sources to create a static library for musl libc. In addition, environment variables for the libseccomp crate are set to link the library statically. Fixes: #1476 Signed-off-by: Manabu Sugimoto --- ci/install_libseccomp.sh | 101 +++++++++++++++++++++++ tools/osbuilder/rootfs-builder/rootfs.sh | 25 +++++- 2 files changed, 122 insertions(+), 4 deletions(-) create mode 100755 ci/install_libseccomp.sh diff --git a/ci/install_libseccomp.sh b/ci/install_libseccomp.sh new file mode 100755 index 0000000000..dbd7bac839 --- /dev/null +++ b/ci/install_libseccomp.sh @@ -0,0 +1,101 @@ +#!/bin/bash +# +# Copyright 2021 Sony Group Corporation +# +# SPDX-License-Identifier: Apache-2.0 +# + +set -o errexit + +cidir=$(dirname "$0") +source "${cidir}/lib.sh" + +clone_tests_repo + +source "${tests_repo_dir}/.ci/lib.sh" + +arch=$(uname -m) + +# Variables for libseccomp +# Currently, specify the libseccomp version directly without using `versions.yaml` +# because the current Snap workflow is incomplete. +# After solving the issue, replace this code by using the `versions.yaml`. +# libseccomp_version=$(get_version "externals.libseccomp.version") +# libseccomp_url=$(get_version "externals.libseccomp.url") +libseccomp_version="2.5.1" +libseccomp_url="https://github.com/seccomp/libseccomp" +libseccomp_tarball="libseccomp-${libseccomp_version}.tar.gz" +libseccomp_tarball_url="${libseccomp_url}/releases/download/v${libseccomp_version}/${libseccomp_tarball}" +cflags="-O2" + +# Variables for gperf +# Currently, specify the gperf version directly without using `versions.yaml` +# because the current Snap workflow is incomplete. +# After solving the issue, replace this code by using the `versions.yaml`. +# gperf_version=$(get_version "externals.gperf.version") +# gperf_url=$(get_version "externals.gperf.url") +gperf_version="3.1" +gperf_url="https://ftp.gnu.org/gnu/gperf" +gperf_tarball="gperf-${gperf_version}.tar.gz" +gperf_tarball_url="${gperf_url}/${gperf_tarball}" + +# We need to build the libseccomp library from sources to create a static library for the musl libc. +# However, ppc64le and s390x have no musl targets in Rust. Hence, we do not set cflags for the musl libc. +if ([ "${arch}" != "ppc64le" ] && [ "${arch}" != "s390x" ]); then + # Set FORTIFY_SOURCE=1 because the musl-libc does not have some functions about FORTIFY_SOURCE=2 + cflags="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=1 -O2" +fi + +die() { + msg="$*" + echo "[Error] ${msg}" >&2 + exit 1 +} + +finish() { + rm -rf "${libseccomp_tarball}" "libseccomp-${libseccomp_version}" "${gperf_tarball}" "gperf-${gperf_version}" +} + +trap finish EXIT + +build_and_install_gperf() { + echo "Build and install gperf version ${gperf_version}" + mkdir -p "${gperf_install_dir}" + curl -sLO "${gperf_tarball_url}" + tar -xf "${gperf_tarball}" + pushd "gperf-${gperf_version}" + ./configure --prefix="${gperf_install_dir}" + make + make install + export PATH=$PATH:"${gperf_install_dir}"/bin + popd + echo "Gperf installed successfully" +} + +build_and_install_libseccomp() { + echo "Build and install libseccomp version ${libseccomp_version}" + mkdir -p "${libseccomp_install_dir}" + curl -sLO "${libseccomp_tarball_url}" + tar -xf "${libseccomp_tarball}" + pushd "libseccomp-${libseccomp_version}" + ./configure --prefix="${libseccomp_install_dir}" CFLAGS="${cflags}" --enable-static + make + make install + popd + echo "Libseccomp installed successfully" +} + +main() { + local libseccomp_install_dir="${1:-}" + local gperf_install_dir="${2:-}" + + if [ -z "${libseccomp_install_dir}" ] || [ -z "${gperf_install_dir}" ]; then + die "Usage: ${0} " + fi + + # gperf is required for building the libseccomp. + build_and_install_gperf + build_and_install_libseccomp +} + +main "$@" diff --git a/tools/osbuilder/rootfs-builder/rootfs.sh b/tools/osbuilder/rootfs-builder/rootfs.sh index ec3a1e6ca4..bfdd4bb271 100755 --- a/tools/osbuilder/rootfs-builder/rootfs.sh +++ b/tools/osbuilder/rootfs-builder/rootfs.sh @@ -23,6 +23,9 @@ DOCKER_RUNTIME=${DOCKER_RUNTIME:-runc} # this GOPATH is for installing yq from install_yq.sh export GOPATH=${GOPATH:-${HOME}/go} LIBC=${LIBC:-musl} +# The kata agent enables seccomp feature. +# However, it is not enforced by default: you need to enable that in the main configuration file. +SECCOMP=${SECCOMP:-"yes"} lib_file="${script_dir}/../scripts/lib.sh" source "$lib_file" @@ -128,6 +131,9 @@ KERNEL_MODULES_DIR Path to a directory containing kernel modules to include in ROOTFS_DIR Path to the directory that is populated with the rootfs. Default value: <${script_name} path>/rootfs- +SECCOMP When set to "no", the kata-agent is built without seccomp capability. + Default value: "yes" + USE_DOCKER If set, build the rootfs inside a container (requires Docker). Default value: @@ -563,8 +569,16 @@ EOT [ "$ARCH" == "aarch64" ] && OLD_PATH=$PATH && export PATH=$PATH:/usr/local/musl/bin agent_dir="${script_dir}/../../../src/agent/" - # For now, rust-agent doesn't support seccomp yet. - SECCOMP="no" + + if [ "${SECCOMP}" == "yes" ]; then + info "Set up libseccomp" + libseccomp_install_dir=$(mktemp -d -t libseccomp.XXXXXXXXXX) + gperf_install_dir=$(mktemp -d -t gperf.XXXXXXXXXX) + bash ${script_dir}/../../../ci/install_libseccomp.sh "${libseccomp_install_dir}" "${gperf_install_dir}" + echo "Set environment variables for the libseccomp crate to link the libseccomp library statically" + export LIBSECCOMP_LINK_TYPE=static + export LIBSECCOMP_LIB_PATH="${libseccomp_install_dir}/lib" + fi info "Build agent" pushd "${agent_dir}" @@ -572,9 +586,12 @@ EOT git checkout "${AGENT_VERSION}" && OK "git checkout successful" || die "checkout agent ${AGENT_VERSION} failed!" fi make clean - make LIBC=${LIBC} INIT=${AGENT_INIT} - make install DESTDIR="${ROOTFS_DIR}" LIBC=${LIBC} INIT=${AGENT_INIT} SECCOMP=${SECCOMP} + make LIBC=${LIBC} INIT=${AGENT_INIT} SECCOMP=${SECCOMP} + make install DESTDIR="${ROOTFS_DIR}" LIBC=${LIBC} INIT=${AGENT_INIT} [ "$ARCH" == "aarch64" ] && export PATH=$OLD_PATH && rm -rf /usr/local/musl + if [ "${SECCOMP}" == "yes" ]; then + rm -rf "${libseccomp_install_dir}" "${gperf_install_dir}" + fi popd else mkdir -p ${AGENT_DIR}