Commit Graph

7 Commits

Author SHA1 Message Date
Kir Kolyshkin 26dc55ef1a seccomp: fix flag test to actually check the value
Add a debug print of seccomp flags value, so the test can check
those (without using something like strace, that is).

Amend the flags setting test with the numeric values expected, and the
logic to check those.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2022-08-30 19:16:08 -07:00
Alban Crequy 58ea21daef seccomp: add support for flags
List of seccomp flags defined in runtime-spec:
* SECCOMP_FILTER_FLAG_TSYNC
* SECCOMP_FILTER_FLAG_LOG
* SECCOMP_FILTER_FLAG_SPEC_ALLOW

Note that runc does not apply SECCOMP_FILTER_FLAG_TSYNC. It does not
make sense to apply the seccomp filter on only one thread; other threads
will be terminated after exec anyway.

See similar commit in crun:
https://github.com/containers/crun/commit/fefabffa2816ea343068ed036a86944393db189a

Note that SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV (introduced by
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?id=c2aa2dfef243
in Linux 5.19-rc1) is not added yet because Linux 5.19 is not released
yet.

Signed-off-by: Alban Crequy <albancrequy@microsoft.com>
2022-07-28 16:25:26 +02:00
Shengjing Zhu e119db7a23 tests: enable seccomp default action tests on arm
Signed-off-by: Shengjing Zhu <zhsj@debian.org>
2022-07-04 16:06:03 +08:00
Mauricio Vásquez 5ae831d9b3 tests: add functional tests for seccomp
Test KILL and ERRNO actions.

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-09-07 13:04:24 +02:00
Giuseppe Scrivano c61f606254 libcontainer: honor seccomp defaultErrnoRet
https://github.com/opencontainers/runtime-spec/pull/1087 added support
for defaultErrnoRet to the OCI runtime specs.

If a defaultErrnoRet is specified, disable patching the generated
libseccomp cBPF.

Closes: https://github.com/opencontainers/runc/issues/2943

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2021-05-17 09:23:32 +02:00
Kir Kolyshkin 41670e21f0 tests/int: rework/simplify setup and teardown
1. Get rid of fixed ROOT, *_BUNDLE, and CONSOLE_SOCKET dirs.
   Now they are temporary directories created in setup_bundle.

2. Automate containers cleanup: instead of having to specify all
   containers to be removed, list and destroy everything (which is
   now possible since every test case has its own unique root).

3. Randomize cgroup paths so two tests running in parallel won't
   use the same cgroup.

Now it's theoretically possible to execute tests in parallel.
Practically it's not possible yet because bats uses GNU parallel,
which do not provide a terminal for whatever it executes, and
many runc tests (all those that run containers with terminal:
true) needs a tty. This may possibly be addressed later.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2021-02-09 20:05:54 -08:00
Aleksa Sarai 8bd19cd5f8 tests: add seccomp -ENOSYS integration test
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
2021-01-28 23:11:25 +11:00