From 8b790e4f4fa3886232955c169c886e52d0414c50 Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Thu, 9 Sep 2021 16:47:38 +0200 Subject: [PATCH 1/3] seccomp agent: Use arch SCMP_ARCH_X86_64 Signed-off-by: Rodrigo Campos --- contrib/cmd/seccompagent/config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/cmd/seccompagent/config.json b/contrib/cmd/seccompagent/config.json index e4f918102..d35c2a639 100644 --- a/contrib/cmd/seccompagent/config.json +++ b/contrib/cmd/seccompagent/config.json @@ -138,7 +138,7 @@ "defaultAction": "SCMP_ACT_ALLOW", "listenerPath": "/run/seccomp-agent.socket", "listenerMetadata": "foo", - "architectures": [ "SCMP_ARCH_X86", "SCMP_ARCH_X32" ], + "architectures": [ "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_X86_64" ], "syscalls": [ { "names": [ "chmod", "fchmod", "fchmodat", "mkdir" ], From 51cd519e4cbc21f4e1fa93c88e37f42a956f6dc8 Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Thu, 9 Sep 2021 16:53:13 +0200 Subject: [PATCH 2/3] seccomp agent: Return non-zero on failures This is useful for future patches, that will run the config in tests. Signed-off-by: Rodrigo Campos --- contrib/cmd/seccompagent/README.md | 13 +++++++++++-- contrib/cmd/seccompagent/config.json | 2 +- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/contrib/cmd/seccompagent/README.md b/contrib/cmd/seccompagent/README.md index 84fe7c14d..47121c4a6 100644 --- a/contrib/cmd/seccompagent/README.md +++ b/contrib/cmd/seccompagent/README.md @@ -45,10 +45,19 @@ The container will output something like this: + touch test-file + chmod 777 test-file chmod: changing permissions of 'test-file': No medium found ++ stat /dev/shm/test-dir-foo + File: /dev/shm/test-dir-foo + Size: 40 Blocks: 0 IO Block: 4096 directory +Device: 3eh/62d Inode: 2 Links: 2 +Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) +Access: 2021-09-09 15:03:13.043716040 +0000 +Modify: 2021-09-09 15:03:13.043716040 +0000 +Change: 2021-09-09 15:03:13.043716040 +0000 + Birth: - + ls -l /dev/shm total 0 -drwxr-xr-x 2 root root 40 Jul 21 14:09 test-dir-foo --rw-r--r-- 1 root root 0 Jul 21 14:09 test-file +drwxr-xr-x 2 root root 40 Sep 9 15:03 test-dir-foo +-rw-r--r-- 1 root root 0 Sep 9 15:03 test-file + echo Note the agent added a suffix for the directory name and chmod fails Note the agent added a suffix for the directory name and chmod fails ``` diff --git a/contrib/cmd/seccompagent/config.json b/contrib/cmd/seccompagent/config.json index d35c2a639..510ed9d98 100644 --- a/contrib/cmd/seccompagent/config.json +++ b/contrib/cmd/seccompagent/config.json @@ -9,7 +9,7 @@ "args": [ "sh", "-c", - "set -x; cd /dev/shm; mkdir test-dir; touch test-file; chmod 777 test-file; ls -l /dev/shm; echo \"Note the agent added a suffix for the directory name and chmod fails\" " + "set -x; cd /dev/shm; mkdir test-dir; touch test-file; chmod 777 test-file; stat /dev/shm/test-dir-foo && ls -l /dev/shm && echo \"Note the agent added a suffix for the directory name and chmod fails\" " ], "env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", From af641cd5879246e412c0d86ff0c8bcc9134b3e1a Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Thu, 9 Sep 2021 17:06:23 +0200 Subject: [PATCH 3/3] seccomp: Add test using the seccomp agent example This commit adds the config.json as generated by the script. Note that the diff is minimal if you see this commit with "git show -w". The differences are mostly whitespaces and some ordering. We add a simple test that runs this and expects sucess. Signed-off-by: Rodrigo Campos --- contrib/cmd/seccompagent/README.md | 7 +- contrib/cmd/seccompagent/config.json | 197 ------------------ .../seccompagent/gen-seccomp-example-cfg.sh | 35 ++++ tests/integration/seccomp-notify.bats | 16 ++ 4 files changed, 54 insertions(+), 201 deletions(-) delete mode 100644 contrib/cmd/seccompagent/config.json create mode 100755 contrib/cmd/seccompagent/gen-seccomp-example-cfg.sh diff --git a/contrib/cmd/seccompagent/README.md b/contrib/cmd/seccompagent/README.md index 47121c4a6..d42d4bda3 100644 --- a/contrib/cmd/seccompagent/README.md +++ b/contrib/cmd/seccompagent/README.md @@ -28,10 +28,9 @@ mkdir rootfs docker export $(docker create busybox) | tar -C rootfs -xvf - ``` -Copy the example `config.json` file from the directory where this README.md is -to the container directory you prepared earlier (`container-seccomp-notify`). -This is a config.json as generated by `runc spec` at time of writing, with only -the `args` and `seccomp` sections modified. +Then, generate a config.json by running the script gen-seccomp-example-cfg.sh +from the directory where this README.md is in the container directory you +prepared earlier (`container-seccomp-notify`). Then start the container: ```bash diff --git a/contrib/cmd/seccompagent/config.json b/contrib/cmd/seccompagent/config.json deleted file mode 100644 index 510ed9d98..000000000 --- a/contrib/cmd/seccompagent/config.json +++ /dev/null @@ -1,197 +0,0 @@ -{ - "ociVersion": "1.0.2-dev", - "process": { - "terminal": true, - "user": { - "uid": 0, - "gid": 0 - }, - "args": [ - "sh", - "-c", - "set -x; cd /dev/shm; mkdir test-dir; touch test-file; chmod 777 test-file; stat /dev/shm/test-dir-foo && ls -l /dev/shm && echo \"Note the agent added a suffix for the directory name and chmod fails\" " - ], - "env": [ - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", - "TERM=xterm" - ], - "cwd": "/", - "capabilities": { - "bounding": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE" - ], - "effective": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE" - ], - "inheritable": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE" - ], - "permitted": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE" - ], - "ambient": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE" - ] - }, - "rlimits": [ - { - "type": "RLIMIT_NOFILE", - "hard": 1024, - "soft": 1024 - } - ], - "noNewPrivileges": true - }, - "root": { - "path": "rootfs", - "readonly": true - }, - "hostname": "runc", - "mounts": [ - { - "destination": "/proc", - "type": "proc", - "source": "proc" - }, - { - "destination": "/dev", - "type": "tmpfs", - "source": "tmpfs", - "options": [ - "nosuid", - "strictatime", - "mode=755", - "size=65536k" - ] - }, - { - "destination": "/dev/pts", - "type": "devpts", - "source": "devpts", - "options": [ - "nosuid", - "noexec", - "newinstance", - "ptmxmode=0666", - "mode=0620", - "gid=5" - ] - }, - { - "destination": "/dev/shm", - "type": "tmpfs", - "source": "shm", - "options": [ - "nosuid", - "noexec", - "nodev", - "mode=1777", - "size=65536k" - ] - }, - { - "destination": "/dev/mqueue", - "type": "mqueue", - "source": "mqueue", - "options": [ - "nosuid", - "noexec", - "nodev" - ] - }, - { - "destination": "/sys", - "type": "sysfs", - "source": "sysfs", - "options": [ - "nosuid", - "noexec", - "nodev", - "ro" - ] - }, - { - "destination": "/sys/fs/cgroup", - "type": "cgroup", - "source": "cgroup", - "options": [ - "nosuid", - "noexec", - "nodev", - "relatime", - "ro" - ] - } - ], - "linux": { - "seccomp": { - "defaultAction": "SCMP_ACT_ALLOW", - "listenerPath": "/run/seccomp-agent.socket", - "listenerMetadata": "foo", - "architectures": [ "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_X86_64" ], - "syscalls": [ - { - "names": [ "chmod", "fchmod", "fchmodat", "mkdir" ], - "action": "SCMP_ACT_NOTIFY" - } - ] - }, - "resources": { - "devices": [ - { - "allow": false, - "access": "rwm" - } - ] - }, - "namespaces": [ - { - "type": "pid" - }, - { - "type": "network" - }, - { - "type": "ipc" - }, - { - "type": "uts" - }, - { - "type": "mount" - }, - { - "type": "cgroup" - } - ], - "maskedPaths": [ - "/proc/acpi", - "/proc/asound", - "/proc/kcore", - "/proc/keys", - "/proc/latency_stats", - "/proc/timer_list", - "/proc/timer_stats", - "/proc/sched_debug", - "/sys/firmware", - "/proc/scsi" - ], - "readonlyPaths": [ - "/proc/bus", - "/proc/fs", - "/proc/irq", - "/proc/sys", - "/proc/sysrq-trigger" - ] - } -} diff --git a/contrib/cmd/seccompagent/gen-seccomp-example-cfg.sh b/contrib/cmd/seccompagent/gen-seccomp-example-cfg.sh new file mode 100755 index 000000000..bd4e209cf --- /dev/null +++ b/contrib/cmd/seccompagent/gen-seccomp-example-cfg.sh @@ -0,0 +1,35 @@ +#!/usr/bin/env bash +# Detect if we are running inside bats (i.e. inside integration tests) or just +# called by an end-user +# bats-core v1.2.1 defines BATS_RUN_TMPDIR +if [ -z "$BATS_RUN_TMPDIR" ]; then + # When not running in bats, we create the config.json + set -e + runc spec +fi + +# We can't source $(dirname $0)/../../../tests/integration/helpers.bash as that +# exits when not running inside bats. We can do hacks, but just to redefine +# update_config() seems clearer. We don't even really need to keep them in sync. +function update_config() { + jq "$1" "./config.json" | awk 'BEGIN{RS="";getline<"-";print>ARGV[1]}' "./config.json" +} + +update_config '.linux.seccomp = { + "defaultAction": "SCMP_ACT_ALLOW", + "listenerPath": "/run/seccomp-agent.socket", + "listenerMetadata": "foo", + "architectures": [ "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_X86_64" ], + "syscalls": [ + { + "names": [ "chmod", "fchmod", "fchmodat", "mkdir" ], + "action": "SCMP_ACT_NOTIFY" + } + ] + }' + +update_config '.process.args = [ + "sh", + "-c", + "set -x; cd /dev/shm; mkdir test-dir; touch test-file; chmod 777 test-file; stat /dev/shm/test-dir-foo && ls -l /dev/shm && echo \"Note the agent added a suffix for the directory name and chmod fails\" " + ]' diff --git a/tests/integration/seccomp-notify.bats b/tests/integration/seccomp-notify.bats index e9c734efd..d5dac521f 100644 --- a/tests/integration/seccomp-notify.bats +++ b/tests/integration/seccomp-notify.bats @@ -198,3 +198,19 @@ function scmp_act_notify_template() { runc run test_busybox [ "$status" -eq 0 ] } + +# Check that example config in the seccomp agent dir works. +@test "runc run [seccomp] (SCMP_ACT_NOTIFY example config)" { + # Run the script used in the seccomp agent example. + # This takes a bare config.json and modifies it to run an example. + "${INTEGRATION_ROOT}/../../contrib/cmd/seccompagent/gen-seccomp-example-cfg.sh" + + # The listenerPath the previous command uses is the default used by the + # seccomp agent. However, inside bats the socket is in a bats tmp dir. + update_config '.linux.seccomp.listenerPath = "'"$SECCCOMP_AGENT_SOCKET"'"' + + runc run test_busybox + + [ "$status" -eq 0 ] + [[ "$output" == *"chmod:"*"test-file"*"No medium found"* ]] +}