Merge pull request #2870 from kolyshkin/seccomp-version

libct/seccomp: remove IsEnabled

libcontainer/seccomp/fixtures/proc_self_status

@@ -1,47 +0,0 @@
-Name:   cat
-State:  R (running)
-Tgid:   19383
-Ngid:   0
-Pid:    19383
-PPid:   19275
-TracerPid:  0
-Uid:    1000    1000    1000    1000
-Gid:    1000    1000    1000    1000
-FDSize: 256
-Groups: 24 25 27 29 30 44 46 102 104 108 111 1000 1001
-NStgid: 19383
-NSpid:  19383
-NSpgid: 19383
-NSsid:  19275
-VmPeak:     5944 kB
-VmSize:     5944 kB
-VmLck:         0 kB
-VmPin:         0 kB
-VmHWM:       744 kB
-VmRSS:       744 kB
-VmData:      324 kB
-VmStk:       136 kB
-VmExe:        48 kB
-VmLib:      1776 kB
-VmPTE:        32 kB
-VmPMD:        12 kB
-VmSwap:        0 kB
-Threads:    1
-SigQ:   0/30067
-SigPnd: 0000000000000000
-ShdPnd: 0000000000000000
-SigBlk: 0000000000000000
-SigIgn: 0000000000000080
-SigCgt: 0000000000000000
-CapInh: 0000000000000000
-CapPrm: 0000000000000000
-CapEff: 0000000000000000
-CapBnd: 0000003fffffffff
-CapAmb: 0000000000000000
-Seccomp:    0
-Cpus_allowed:   f
-Cpus_allowed_list:  0-3
-Mems_allowed:   00000000,00000001
-Mems_allowed_list:  0
-voluntary_ctxt_switches:    0
-nonvoluntary_ctxt_switches: 1

libcontainer/seccomp/seccomp_linux.go

@@ -3,11 +3,8 @@
 package seccomp
 
 import (
-	"bufio"
 	"errors"
 	"fmt"
-	"os"
-	"strings"
 
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/seccomp/patchbpf"
@@ -80,24 +77,6 @@ func InitSeccomp(config *configs.Seccomp) error {
 	return nil
 }
 
-// IsEnabled returns if the kernel has been configured to support seccomp.
-func IsEnabled() bool {
-	// Try to read from /proc/self/status for kernels > 3.8
-	s, err := parseStatusFile("/proc/self/status")
-	if err != nil {
-		// Check if Seccomp is supported, via CONFIG_SECCOMP.
-		if err := unix.Prctl(unix.PR_GET_SECCOMP, 0, 0, 0, 0); err != unix.EINVAL {
-			// Make sure the kernel has CONFIG_SECCOMP_FILTER.
-			if err := unix.Prctl(unix.PR_SET_SECCOMP, unix.SECCOMP_MODE_FILTER, 0, 0, 0); err != unix.EINVAL {
-				return true
-			}
-		}
-		return false
-	}
-	_, ok := s["Seccomp"]
-	return ok
-}
-
 // Convert Libcontainer Action to Libseccomp ScmpAction
 func getAction(act configs.Action, errnoRet *uint) (libseccomp.ScmpAction, error) {
 	switch act {
@@ -237,33 +216,6 @@ func matchCall(filter *libseccomp.ScmpFilter, call *configs.Syscall) error {
 	return nil
 }
 
-func parseStatusFile(path string) (map[string]string, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-
-	s := bufio.NewScanner(f)
-	status := make(map[string]string)
-
-	for s.Scan() {
-		text := s.Text()
-		parts := strings.Split(text, ":")
-
-		if len(parts) <= 1 {
-			continue
-		}
-
-		status[parts[0]] = parts[1]
-	}
-	if err := s.Err(); err != nil {
-		return nil, err
-	}
-
-	return status, nil
-}
-
 // Version returns major, minor, and micro.
 func Version() (uint, uint, uint) {
 	return libseccomp.GetLibraryVersion()

libcontainer/seccomp/seccomp_linux_test.go

@@ -1,17 +0,0 @@
-// +build linux,cgo,seccomp
-
-package seccomp
-
-import "testing"
-
-func TestParseStatusFile(t *testing.T) {
-	s, err := parseStatusFile("fixtures/proc_self_status")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if _, ok := s["Seccomp"]; !ok {
-
-		t.Fatal("expected to find 'Seccomp' in the map but did not.")
-	}
-}

libcontainer/seccomp/seccomp_unsupported.go

@@ -18,11 +18,6 @@ func InitSeccomp(config *configs.Seccomp) error {
 	return nil
 }
 
-// IsEnabled returns false, because it is not supported.
-func IsEnabled() bool {
-	return false
-}
-
 // Version returns major, minor, and micro.
 func Version() (uint, uint, uint) {
 	return 0, 0, 0

main.go

@@ -64,8 +64,9 @@ func main() {
 	}
 	v = append(v, "spec: "+specs.Version)
 	v = append(v, "go: "+runtime.Version())
-	if seccomp.IsEnabled() {
+
-		major, minor, micro := seccomp.Version()
+	major, minor, micro := seccomp.Version()
+	if major+minor+micro > 0 {
 		v = append(v, fmt.Sprintf("libseccomp: %d.%d.%d", major, minor, micro))
 	}
 	app.Version = strings.Join(v, "\n")