From 9b2f1e6fb659704bc58927454499f33dccdb48de Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 23 Mar 2021 16:06:03 -0700 Subject: [PATCH 1/2] runc version: don't use seccomp.IsEnabled As pointed out to in [1], seccomp.IsEnabled does some runtime checks, while here (when printing libseccomp version) we should merely print the version number of libseccomp, if compiled in. Change the code to check if the version is non-zero (as seccomp.Version returns 0, 0, 0 in case seccomp is not compiled in. [1] https://github.com/opencontainers/runc/pull/2866 Signed-off-by: Kir Kolyshkin --- main.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/main.go b/main.go index 57d7f4282..1bddcc434 100644 --- a/main.go +++ b/main.go @@ -64,8 +64,9 @@ func main() { } v = append(v, "spec: "+specs.Version) v = append(v, "go: "+runtime.Version()) - if seccomp.IsEnabled() { - major, minor, micro := seccomp.Version() + + major, minor, micro := seccomp.Version() + if major+minor+micro > 0 { v = append(v, fmt.Sprintf("libseccomp: %d.%d.%d", major, minor, micro)) } app.Version = strings.Join(v, "\n") From ac93746c4dce5e989e760a6f19366b15d9565fb1 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 23 Mar 2021 16:37:39 -0700 Subject: [PATCH 2/2] libct/seccomp: rm IsEnabled seccomp.IsEnabled is not well defined (the presence of Seccomp: field in /proc/self/status does not tell us whether CONFIG_SECCOMP_FILTER is enabled in the kernel; parsing all keys in /proc/self/status is a moderate waste of resources, etc). I traced its addition back to [1] and even in there it is not clear what for it was added. There were never an internal user (except for the recently added one, removed by the previous commit), and can't find any external users (but found two copy-pastes of this code, suffering from the same problems, see [2] and [3]). Since it is broken and has no users, remove it. [1] https://github.com/opencontainers/runc/pull/471 [2] https://github.com/containerd/containerd/blob/master/pkg/seccomp/seccomp_linux.go [3] https://github.com/containers/common/blob/master/pkg/seccomp/supported.go Signed-off-by: Kir Kolyshkin --- .../seccomp/fixtures/proc_self_status | 47 ------------------ libcontainer/seccomp/seccomp_linux.go | 48 ------------------- libcontainer/seccomp/seccomp_linux_test.go | 17 ------- libcontainer/seccomp/seccomp_unsupported.go | 5 -- 4 files changed, 117 deletions(-) delete mode 100644 libcontainer/seccomp/fixtures/proc_self_status delete mode 100644 libcontainer/seccomp/seccomp_linux_test.go diff --git a/libcontainer/seccomp/fixtures/proc_self_status b/libcontainer/seccomp/fixtures/proc_self_status deleted file mode 100644 index 0e0084f6c..000000000 --- a/libcontainer/seccomp/fixtures/proc_self_status +++ /dev/null @@ -1,47 +0,0 @@ -Name: cat -State: R (running) -Tgid: 19383 -Ngid: 0 -Pid: 19383 -PPid: 19275 -TracerPid: 0 -Uid: 1000 1000 1000 1000 -Gid: 1000 1000 1000 1000 -FDSize: 256 -Groups: 24 25 27 29 30 44 46 102 104 108 111 1000 1001 -NStgid: 19383 -NSpid: 19383 -NSpgid: 19383 -NSsid: 19275 -VmPeak: 5944 kB -VmSize: 5944 kB -VmLck: 0 kB -VmPin: 0 kB -VmHWM: 744 kB -VmRSS: 744 kB -VmData: 324 kB -VmStk: 136 kB -VmExe: 48 kB -VmLib: 1776 kB -VmPTE: 32 kB -VmPMD: 12 kB -VmSwap: 0 kB -Threads: 1 -SigQ: 0/30067 -SigPnd: 0000000000000000 -ShdPnd: 0000000000000000 -SigBlk: 0000000000000000 -SigIgn: 0000000000000080 -SigCgt: 0000000000000000 -CapInh: 0000000000000000 -CapPrm: 0000000000000000 -CapEff: 0000000000000000 -CapBnd: 0000003fffffffff -CapAmb: 0000000000000000 -Seccomp: 0 -Cpus_allowed: f -Cpus_allowed_list: 0-3 -Mems_allowed: 00000000,00000001 -Mems_allowed_list: 0 -voluntary_ctxt_switches: 0 -nonvoluntary_ctxt_switches: 1 diff --git a/libcontainer/seccomp/seccomp_linux.go b/libcontainer/seccomp/seccomp_linux.go index 5e7b365c5..b6d197845 100644 --- a/libcontainer/seccomp/seccomp_linux.go +++ b/libcontainer/seccomp/seccomp_linux.go @@ -3,11 +3,8 @@ package seccomp import ( - "bufio" "errors" "fmt" - "os" - "strings" "github.com/opencontainers/runc/libcontainer/configs" "github.com/opencontainers/runc/libcontainer/seccomp/patchbpf" @@ -80,24 +77,6 @@ func InitSeccomp(config *configs.Seccomp) error { return nil } -// IsEnabled returns if the kernel has been configured to support seccomp. -func IsEnabled() bool { - // Try to read from /proc/self/status for kernels > 3.8 - s, err := parseStatusFile("/proc/self/status") - if err != nil { - // Check if Seccomp is supported, via CONFIG_SECCOMP. - if err := unix.Prctl(unix.PR_GET_SECCOMP, 0, 0, 0, 0); err != unix.EINVAL { - // Make sure the kernel has CONFIG_SECCOMP_FILTER. - if err := unix.Prctl(unix.PR_SET_SECCOMP, unix.SECCOMP_MODE_FILTER, 0, 0, 0); err != unix.EINVAL { - return true - } - } - return false - } - _, ok := s["Seccomp"] - return ok -} - // Convert Libcontainer Action to Libseccomp ScmpAction func getAction(act configs.Action, errnoRet *uint) (libseccomp.ScmpAction, error) { switch act { @@ -237,33 +216,6 @@ func matchCall(filter *libseccomp.ScmpFilter, call *configs.Syscall) error { return nil } -func parseStatusFile(path string) (map[string]string, error) { - f, err := os.Open(path) - if err != nil { - return nil, err - } - defer f.Close() - - s := bufio.NewScanner(f) - status := make(map[string]string) - - for s.Scan() { - text := s.Text() - parts := strings.Split(text, ":") - - if len(parts) <= 1 { - continue - } - - status[parts[0]] = parts[1] - } - if err := s.Err(); err != nil { - return nil, err - } - - return status, nil -} - // Version returns major, minor, and micro. func Version() (uint, uint, uint) { return libseccomp.GetLibraryVersion() diff --git a/libcontainer/seccomp/seccomp_linux_test.go b/libcontainer/seccomp/seccomp_linux_test.go deleted file mode 100644 index 67a2ef6ab..000000000 --- a/libcontainer/seccomp/seccomp_linux_test.go +++ /dev/null @@ -1,17 +0,0 @@ -// +build linux,cgo,seccomp - -package seccomp - -import "testing" - -func TestParseStatusFile(t *testing.T) { - s, err := parseStatusFile("fixtures/proc_self_status") - if err != nil { - t.Fatal(err) - } - - if _, ok := s["Seccomp"]; !ok { - - t.Fatal("expected to find 'Seccomp' in the map but did not.") - } -} diff --git a/libcontainer/seccomp/seccomp_unsupported.go b/libcontainer/seccomp/seccomp_unsupported.go index 244886a42..8b7973e9a 100644 --- a/libcontainer/seccomp/seccomp_unsupported.go +++ b/libcontainer/seccomp/seccomp_unsupported.go @@ -18,11 +18,6 @@ func InitSeccomp(config *configs.Seccomp) error { return nil } -// IsEnabled returns false, because it is not supported. -func IsEnabled() bool { - return false -} - // Version returns major, minor, and micro. func Version() (uint, uint, uint) { return 0, 0, 0