libct/seccomp: rm IsEnabled

seccomp.IsEnabled is not well defined (the presence of Seccomp: field
in /proc/self/status does not tell us whether CONFIG_SECCOMP_FILTER
is enabled in the kernel; parsing all keys in /proc/self/status is a
moderate waste of resources, etc).

I traced its addition back to [1] and even in there it is not clear
what for it was added. There were never an internal user (except
for the recently added one, removed by the previous commit), and
can't find any external users (but found two copy-pastes of this
code, suffering from the same problems, see [2] and [3]).

Since it is broken and has no users, remove it.

[1] https://github.com/opencontainers/runc/pull/471
[2] https://github.com/containerd/containerd/blob/master/pkg/seccomp/seccomp_linux.go
[3] https://github.com/containers/common/blob/master/pkg/seccomp/supported.go

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

libcontainer/seccomp/fixtures/proc_self_status

@@ -1,47 +0,0 @@
-Name:   cat
-State:  R (running)
-Tgid:   19383
-Ngid:   0
-Pid:    19383
-PPid:   19275
-TracerPid:  0
-Uid:    1000    1000    1000    1000
-Gid:    1000    1000    1000    1000
-FDSize: 256
-Groups: 24 25 27 29 30 44 46 102 104 108 111 1000 1001
-NStgid: 19383
-NSpid:  19383
-NSpgid: 19383
-NSsid:  19275
-VmPeak:     5944 kB
-VmSize:     5944 kB
-VmLck:         0 kB
-VmPin:         0 kB
-VmHWM:       744 kB
-VmRSS:       744 kB
-VmData:      324 kB
-VmStk:       136 kB
-VmExe:        48 kB
-VmLib:      1776 kB
-VmPTE:        32 kB
-VmPMD:        12 kB
-VmSwap:        0 kB
-Threads:    1
-SigQ:   0/30067
-SigPnd: 0000000000000000
-ShdPnd: 0000000000000000
-SigBlk: 0000000000000000
-SigIgn: 0000000000000080
-SigCgt: 0000000000000000
-CapInh: 0000000000000000
-CapPrm: 0000000000000000
-CapEff: 0000000000000000
-CapBnd: 0000003fffffffff
-CapAmb: 0000000000000000
-Seccomp:    0
-Cpus_allowed:   f
-Cpus_allowed_list:  0-3
-Mems_allowed:   00000000,00000001
-Mems_allowed_list:  0
-voluntary_ctxt_switches:    0
-nonvoluntary_ctxt_switches: 1

libcontainer/seccomp/seccomp_linux.go

@@ -3,11 +3,8 @@
 package seccomp
 
 import (
-	"bufio"
 	"errors"
 	"fmt"
-	"os"
-	"strings"
 
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/seccomp/patchbpf"
@@ -80,24 +77,6 @@ func InitSeccomp(config *configs.Seccomp) error {
 	return nil
 }
 
-// IsEnabled returns if the kernel has been configured to support seccomp.
-func IsEnabled() bool {
-	// Try to read from /proc/self/status for kernels > 3.8
-	s, err := parseStatusFile("/proc/self/status")
-	if err != nil {
-		// Check if Seccomp is supported, via CONFIG_SECCOMP.
-		if err := unix.Prctl(unix.PR_GET_SECCOMP, 0, 0, 0, 0); err != unix.EINVAL {
-			// Make sure the kernel has CONFIG_SECCOMP_FILTER.
-			if err := unix.Prctl(unix.PR_SET_SECCOMP, unix.SECCOMP_MODE_FILTER, 0, 0, 0); err != unix.EINVAL {
-				return true
-			}
-		}
-		return false
-	}
-	_, ok := s["Seccomp"]
-	return ok
-}
-
 // Convert Libcontainer Action to Libseccomp ScmpAction
 func getAction(act configs.Action, errnoRet *uint) (libseccomp.ScmpAction, error) {
 	switch act {
@@ -237,33 +216,6 @@ func matchCall(filter *libseccomp.ScmpFilter, call *configs.Syscall) error {
 	return nil
 }
 
-func parseStatusFile(path string) (map[string]string, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-
-	s := bufio.NewScanner(f)
-	status := make(map[string]string)
-
-	for s.Scan() {
-		text := s.Text()
-		parts := strings.Split(text, ":")
-
-		if len(parts) <= 1 {
-			continue
-		}
-
-		status[parts[0]] = parts[1]
-	}
-	if err := s.Err(); err != nil {
-		return nil, err
-	}
-
-	return status, nil
-}
-
 // Version returns major, minor, and micro.
 func Version() (uint, uint, uint) {
 	return libseccomp.GetLibraryVersion()

libcontainer/seccomp/seccomp_linux_test.go

@@ -1,17 +0,0 @@
-// +build linux,cgo,seccomp
-
-package seccomp
-
-import "testing"
-
-func TestParseStatusFile(t *testing.T) {
-	s, err := parseStatusFile("fixtures/proc_self_status")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if _, ok := s["Seccomp"]; !ok {
-
-		t.Fatal("expected to find 'Seccomp' in the map but did not.")
-	}
-}

libcontainer/seccomp/seccomp_unsupported.go

@@ -18,11 +18,6 @@ func InitSeccomp(config *configs.Seccomp) error {
 	return nil
 }
 
-// IsEnabled returns false, because it is not supported.
-func IsEnabled() bool {
-	return false
-}
-
 // Version returns major, minor, and micro.
 func Version() (uint, uint, uint) {
 	return 0, 0, 0