mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-10 21:53:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

Support specs.LinuxSeccompFlagWaitKillableRecv

Browse Source 
This adds support for WaitKillableRecv seccomp flag
(also known as SCMP_FLTATR_CTL_WAITKILL in libseccomp and
as SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV in the kernel).

This requires:
 - libseccomp >= 2.6.0
 - libseccomp-golang >= 0.11.0
 - linux kernel >= 5.19

Note that this flag does not make sense without NEW_LISTENER, and
the kernel returns EINVAL when SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV
is set but SECCOMP_FILTER_FLAG_NEW_LISTENER is not set.

For runc this means that .linux.seccomp.listenerPath should also be set,
and some of the seccomp rules should have SCMP_ACT_NOTIFY action. This
is why the flag is tested separately in seccomp-notify.bats.

At the moment the only adequate CI environment for this functionality is
Fedora 43. On all other platforms (including CentOS 10 and Ubuntu 24.04)
it is skipped similar to this:

> ok 251 runc run [seccomp] (SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) # skip requires libseccomp >= 2.6.0 and API level >= 7 (current version: 2.5.6, API level: 6)

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
Kir Kolyshkin
2026-03-09 13:27:15 -07:00
parent 496b68a305
commit 0079bee17f
7 changed files with 46 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/seccomp-notify.bats
+21
View File
@@ -58,6 +58,27 @@ function scmp_act_notify_template() {
[ "$status" -eq 0 ]
}
@test "runc run [seccomp] (SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)" {
scmp_act_notify_template "mkdir /dev/shm/foo && stat /dev/shm/foo-bar" false '"mkdir"'
update_config '.linux.seccomp.flags = [ "SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV" ]'
runc --debug run test_busybox
if [ "$status" -ne 0 ]; then
# Older libseccomp or kernel?
if [[ "$output" == *"error adding WaitKill flag to seccomp filter: SetWaitKill requires "* ]]; then
skip "$(sed -e 's/^.*SetWaitKill //' -e 's/" func=.*$//' <<<"$output")"
fi
# Otherwise, fail.
[ "$status" -eq 0 ]
fi
# Check the numeric flags value, as printed in the debug log, is as expected.
# 32: SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV
# 8: SECCOMP_FILTER_FLAG_NEW_LISTENER
exp='"seccomp filter flags: 40"'
echo "expecting $exp"
[[ "$output" == *"$exp"* ]]
}
# Test actions not-handled by the agent work fine. noNewPrivileges FALSE.
@test "runc exec [seccomp] (SCMP_ACT_NOTIFY noNewPrivileges false)" {
requires root
tests/integration/seccomp.bats
+4 -1
View File
@@ -102,8 +102,11 @@ function flags_value() {
# Get the list of flags supported by runc/seccomp/kernel,
# or "null" if no flags are supported or runc is too old.
#
# Filter out WAIT_KILLABLE_RECV as it requires a listener,
# and thus tested separately in seccomp-notify.bats.
mapfile -t flags < <(__runc features | jq -c '.linux.seccomp.supportedFlags' |
tr -d '[]\n' | tr ',' '\n')
tr -d '[]\n' | tr ',' '\n' | grep -v 'WAIT_KILLABLE_RECV')
# This is a set of all possible flag combinations to test.
declare -A TEST_CASES=(