New seccomp format

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 5ff21add06ce0e502b41a194077daad311901996
Component: engine

components/engine/profiles/seccomp/generate.go

@@ -8,7 +8,6 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/docker/docker/oci"
 	"github.com/docker/docker/profiles/seccomp"
 )
 
@@ -21,10 +20,8 @@ func main() {
 	}
 	f := filepath.Join(wd, "default.json")
 
-	rs := oci.DefaultSpec()
-
 	// write the default profile to the file
-	b, err := json.MarshalIndent(seccomp.DefaultProfile(&rs), "", "\t")
+	b, err := json.MarshalIndent(seccomp.DefaultProfile(), "", "\t")
 	if err != nil {
 		panic(err)
 	}

components/engine/profiles/seccomp/seccomp.go

@@ -4,30 +4,42 @@ package seccomp
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 
+	"github.com/docker/docker/pkg/stringutils"
 	"github.com/docker/engine-api/types"
 	"github.com/opencontainers/runtime-spec/specs-go"
+	libseccomp "github.com/seccomp/libseccomp-golang"
 )
 
 //go:generate go run -tags 'seccomp' generate.go
 
 // GetDefaultProfile returns the default seccomp profile.
 func GetDefaultProfile(rs *specs.Spec) (*specs.Seccomp, error) {
-	return setupSeccomp(DefaultProfile(rs))
+	return setupSeccomp(DefaultProfile(), rs)
 }
 
 // LoadProfile takes a file path and decodes the seccomp profile.
-func LoadProfile(body string) (*specs.Seccomp, error) {
+func LoadProfile(body string, rs *specs.Spec) (*specs.Seccomp, error) {
 	var config types.Seccomp
 	if err := json.Unmarshal([]byte(body), &config); err != nil {
 		return nil, fmt.Errorf("Decoding seccomp profile failed: %v", err)
 	}
-
-	return setupSeccomp(&config)
+	return setupSeccomp(&config, rs)
 }
 
-func setupSeccomp(config *types.Seccomp) (newConfig *specs.Seccomp, err error) {
+var nativeToSeccomp = map[string]types.Arch{
+	"amd64":       types.ArchX86_64,
+	"arm64":       types.ArchAARCH64,
+	"mips64":      types.ArchMIPS64,
+	"mips64n32":   types.ArchMIPS64N32,
+	"mipsel64":    types.ArchMIPSEL64,
+	"mipsel64n32": types.ArchMIPSEL64N32,
+	"s390x":       types.ArchS390X,
+}
+
+func setupSeccomp(config *types.Seccomp, rs *specs.Spec) (*specs.Seccomp, error) {
 	if config == nil {
 		return nil, nil
 	}
@@ -37,38 +49,102 @@ func setupSeccomp(config *types.Seccomp) (newConfig *specs.Seccomp, err error) {
 		return nil, nil
 	}
 
-	newConfig = &specs.Seccomp{}
+	newConfig := &specs.Seccomp{}
+
+	var arch string
+	var native, err = libseccomp.GetNativeArch()
+	if err == nil {
+		arch = native.String()
+	}
+
+	if len(config.Architectures) != 0 && len(config.ArchMap) != 0 {
+		return nil, errors.New("'architectures' and 'archMap' were specified in the seccomp profile, use either 'architectures' or 'archMap'")
+	}
 
 	// if config.Architectures == 0 then libseccomp will figure out the architecture to use
-	if len(config.Architectures) > 0 {
-		for _, arch := range config.Architectures {
-			newConfig.Architectures = append(newConfig.Architectures, specs.Arch(arch))
+	if len(config.Architectures) != 0 {
+		for _, a := range config.Architectures {
+			newConfig.Architectures = append(newConfig.Architectures, specs.Arch(a))
+		}
+	}
+
+	if len(config.ArchMap) != 0 {
+		for _, a := range config.ArchMap {
+			seccompArch, ok := nativeToSeccomp[arch]
+			if ok {
+				if a.Arch == seccompArch {
+					newConfig.Architectures = append(newConfig.Architectures, specs.Arch(a.Arch))
+					for _, sa := range a.SubArches {
+						newConfig.Architectures = append(newConfig.Architectures, specs.Arch(sa))
+					}
+					break
+				}
+			}
 		}
 	}
 
 	newConfig.DefaultAction = specs.Action(config.DefaultAction)
 
-	// Loop through all syscall blocks and convert them to libcontainer format
+Loop:
+	// Loop through all syscall blocks and convert them to libcontainer format after filtering them
 	for _, call := range config.Syscalls {
-		newCall := specs.Syscall{
-			Name:   call.Name,
-			Action: specs.Action(call.Action),
-		}
-
-		// Loop through all the arguments of the syscall and convert them
-		for _, arg := range call.Args {
-			newArg := specs.Arg{
-				Index:    arg.Index,
-				Value:    arg.Value,
-				ValueTwo: arg.ValueTwo,
-				Op:       specs.Operator(arg.Op),
+		if len(call.Excludes.Arches) > 0 {
+			if stringutils.InSlice(call.Excludes.Arches, arch) {
+				continue Loop
+			}
+		}
+		if len(call.Excludes.Caps) > 0 {
+			for _, c := range call.Excludes.Caps {
+				if stringutils.InSlice(rs.Process.Capabilities, c) {
+					continue Loop
+				}
+			}
+		}
+		if len(call.Includes.Arches) > 0 {
+			if !stringutils.InSlice(call.Includes.Arches, arch) {
+				continue Loop
+			}
+		}
+		if len(call.Includes.Caps) > 0 {
+			for _, c := range call.Includes.Caps {
+				if !stringutils.InSlice(rs.Process.Capabilities, c) {
+					continue Loop
+				}
 			}
-
-			newCall.Args = append(newCall.Args, newArg)
 		}
 
-		newConfig.Syscalls = append(newConfig.Syscalls, newCall)
+		if call.Name != "" && len(call.Names) != 0 {
+			return nil, errors.New("'name' and 'names' were specified in the seccomp profile, use either 'name' or 'names'")
+		}
+
+		if call.Name != "" {
+			newConfig.Syscalls = append(newConfig.Syscalls, createSpecsSyscall(call.Name, call.Action, call.Args))
+		}
+
+		for _, n := range call.Names {
+			newConfig.Syscalls = append(newConfig.Syscalls, createSpecsSyscall(n, call.Action, call.Args))
+		}
 	}
 
 	return newConfig, nil
 }
+
+func createSpecsSyscall(name string, action types.Action, args []*types.Arg) specs.Syscall {
+	newCall := specs.Syscall{
+		Name:   name,
+		Action: specs.Action(action),
+	}
+
+	// Loop through all the arguments of the syscall and convert them
+	for _, arg := range args {
+		newArg := specs.Arg{
+			Index:    arg.Index,
+			Value:    arg.Value,
+			ValueTwo: arg.ValueTwo,
+			Op:       specs.Operator(arg.Op),
+		}
+
+		newCall.Args = append(newCall.Args, newArg)
+	}
+	return newCall
+}

components/engine/profiles/seccomp/seccomp_test.go

@@ -5,6 +5,8 @@ package seccomp
 import (
 	"io/ioutil"
 	"testing"
+
+	"github.com/docker/docker/oci"
 )
 
 func TestLoadProfile(t *testing.T) {
@@ -12,7 +14,8 @@ func TestLoadProfile(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if _, err := LoadProfile(string(f)); err != nil {
+	rs := oci.DefaultSpec()
+	if _, err := LoadProfile(string(f), &rs); err != nil {
 		t.Fatal(err)
 	}
 }
@@ -22,7 +25,8 @@ func TestLoadDefaultProfile(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if _, err := LoadProfile(string(f)); err != nil {
+	rs := oci.DefaultSpec()
+	if _, err := LoadProfile(string(f), &rs); err != nil {
 		t.Fatal(err)
 	}
 }