From af641cd5879246e412c0d86ff0c8bcc9134b3e1a Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Thu, 9 Sep 2021 17:06:23 +0200 Subject: [PATCH] seccomp: Add test using the seccomp agent example This commit adds the config.json as generated by the script. Note that the diff is minimal if you see this commit with "git show -w". The differences are mostly whitespaces and some ordering. We add a simple test that runs this and expects sucess. Signed-off-by: Rodrigo Campos --- contrib/cmd/seccompagent/README.md | 7 +- contrib/cmd/seccompagent/config.json | 197 ------------------ .../seccompagent/gen-seccomp-example-cfg.sh | 35 ++++ tests/integration/seccomp-notify.bats | 16 ++ 4 files changed, 54 insertions(+), 201 deletions(-) delete mode 100644 contrib/cmd/seccompagent/config.json create mode 100755 contrib/cmd/seccompagent/gen-seccomp-example-cfg.sh diff --git a/contrib/cmd/seccompagent/README.md b/contrib/cmd/seccompagent/README.md index 47121c4a6..d42d4bda3 100644 --- a/contrib/cmd/seccompagent/README.md +++ b/contrib/cmd/seccompagent/README.md @@ -28,10 +28,9 @@ mkdir rootfs docker export $(docker create busybox) | tar -C rootfs -xvf - ``` -Copy the example `config.json` file from the directory where this README.md is -to the container directory you prepared earlier (`container-seccomp-notify`). -This is a config.json as generated by `runc spec` at time of writing, with only -the `args` and `seccomp` sections modified. +Then, generate a config.json by running the script gen-seccomp-example-cfg.sh +from the directory where this README.md is in the container directory you +prepared earlier (`container-seccomp-notify`). Then start the container: ```bash diff --git a/contrib/cmd/seccompagent/config.json b/contrib/cmd/seccompagent/config.json deleted file mode 100644 index 510ed9d98..000000000 --- a/contrib/cmd/seccompagent/config.json +++ /dev/null @@ -1,197 +0,0 @@ -{ - "ociVersion": "1.0.2-dev", - "process": { - "terminal": true, - "user": { - "uid": 0, - "gid": 0 - }, - "args": [ - "sh", - "-c", - "set -x; cd /dev/shm; mkdir test-dir; touch test-file; chmod 777 test-file; stat /dev/shm/test-dir-foo && ls -l /dev/shm && echo \"Note the agent added a suffix for the directory name and chmod fails\" " - ], - "env": [ - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", - "TERM=xterm" - ], - "cwd": "/", - "capabilities": { - "bounding": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE" - ], - "effective": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE" - ], - "inheritable": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE" - ], - "permitted": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE" - ], - "ambient": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE" - ] - }, - "rlimits": [ - { - "type": "RLIMIT_NOFILE", - "hard": 1024, - "soft": 1024 - } - ], - "noNewPrivileges": true - }, - "root": { - "path": "rootfs", - "readonly": true - }, - "hostname": "runc", - "mounts": [ - { - "destination": "/proc", - "type": "proc", - "source": "proc" - }, - { - "destination": "/dev", - "type": "tmpfs", - "source": "tmpfs", - "options": [ - "nosuid", - "strictatime", - "mode=755", - "size=65536k" - ] - }, - { - "destination": "/dev/pts", - "type": "devpts", - "source": "devpts", - "options": [ - "nosuid", - "noexec", - "newinstance", - "ptmxmode=0666", - "mode=0620", - "gid=5" - ] - }, - { - "destination": "/dev/shm", - "type": "tmpfs", - "source": "shm", - "options": [ - "nosuid", - "noexec", - "nodev", - "mode=1777", - "size=65536k" - ] - }, - { - "destination": "/dev/mqueue", - "type": "mqueue", - "source": "mqueue", - "options": [ - "nosuid", - "noexec", - "nodev" - ] - }, - { - "destination": "/sys", - "type": "sysfs", - "source": "sysfs", - "options": [ - "nosuid", - "noexec", - "nodev", - "ro" - ] - }, - { - "destination": "/sys/fs/cgroup", - "type": "cgroup", - "source": "cgroup", - "options": [ - "nosuid", - "noexec", - "nodev", - "relatime", - "ro" - ] - } - ], - "linux": { - "seccomp": { - "defaultAction": "SCMP_ACT_ALLOW", - "listenerPath": "/run/seccomp-agent.socket", - "listenerMetadata": "foo", - "architectures": [ "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_X86_64" ], - "syscalls": [ - { - "names": [ "chmod", "fchmod", "fchmodat", "mkdir" ], - "action": "SCMP_ACT_NOTIFY" - } - ] - }, - "resources": { - "devices": [ - { - "allow": false, - "access": "rwm" - } - ] - }, - "namespaces": [ - { - "type": "pid" - }, - { - "type": "network" - }, - { - "type": "ipc" - }, - { - "type": "uts" - }, - { - "type": "mount" - }, - { - "type": "cgroup" - } - ], - "maskedPaths": [ - "/proc/acpi", - "/proc/asound", - "/proc/kcore", - "/proc/keys", - "/proc/latency_stats", - "/proc/timer_list", - "/proc/timer_stats", - "/proc/sched_debug", - "/sys/firmware", - "/proc/scsi" - ], - "readonlyPaths": [ - "/proc/bus", - "/proc/fs", - "/proc/irq", - "/proc/sys", - "/proc/sysrq-trigger" - ] - } -} diff --git a/contrib/cmd/seccompagent/gen-seccomp-example-cfg.sh b/contrib/cmd/seccompagent/gen-seccomp-example-cfg.sh new file mode 100755 index 000000000..bd4e209cf --- /dev/null +++ b/contrib/cmd/seccompagent/gen-seccomp-example-cfg.sh @@ -0,0 +1,35 @@ +#!/usr/bin/env bash +# Detect if we are running inside bats (i.e. inside integration tests) or just +# called by an end-user +# bats-core v1.2.1 defines BATS_RUN_TMPDIR +if [ -z "$BATS_RUN_TMPDIR" ]; then + # When not running in bats, we create the config.json + set -e + runc spec +fi + +# We can't source $(dirname $0)/../../../tests/integration/helpers.bash as that +# exits when not running inside bats. We can do hacks, but just to redefine +# update_config() seems clearer. We don't even really need to keep them in sync. +function update_config() { + jq "$1" "./config.json" | awk 'BEGIN{RS="";getline<"-";print>ARGV[1]}' "./config.json" +} + +update_config '.linux.seccomp = { + "defaultAction": "SCMP_ACT_ALLOW", + "listenerPath": "/run/seccomp-agent.socket", + "listenerMetadata": "foo", + "architectures": [ "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_X86_64" ], + "syscalls": [ + { + "names": [ "chmod", "fchmod", "fchmodat", "mkdir" ], + "action": "SCMP_ACT_NOTIFY" + } + ] + }' + +update_config '.process.args = [ + "sh", + "-c", + "set -x; cd /dev/shm; mkdir test-dir; touch test-file; chmod 777 test-file; stat /dev/shm/test-dir-foo && ls -l /dev/shm && echo \"Note the agent added a suffix for the directory name and chmod fails\" " + ]' diff --git a/tests/integration/seccomp-notify.bats b/tests/integration/seccomp-notify.bats index e9c734efd..d5dac521f 100644 --- a/tests/integration/seccomp-notify.bats +++ b/tests/integration/seccomp-notify.bats @@ -198,3 +198,19 @@ function scmp_act_notify_template() { runc run test_busybox [ "$status" -eq 0 ] } + +# Check that example config in the seccomp agent dir works. +@test "runc run [seccomp] (SCMP_ACT_NOTIFY example config)" { + # Run the script used in the seccomp agent example. + # This takes a bare config.json and modifies it to run an example. + "${INTEGRATION_ROOT}/../../contrib/cmd/seccompagent/gen-seccomp-example-cfg.sh" + + # The listenerPath the previous command uses is the default used by the + # seccomp agent. However, inside bats the socket is in a bats tmp dir. + update_config '.linux.seccomp.listenerPath = "'"$SECCCOMP_AGENT_SOCKET"'"' + + runc run test_busybox + + [ "$status" -eq 0 ] + [[ "$output" == *"chmod:"*"test-file"*"No medium found"* ]] +}