Alban Crequy 2b025c0173 Implement Seccomp Notify ...

This commit implements support for the SCMP_ACT_NOTIFY action. It
requires libseccomp-2.5.0 to work but runc still works with older
libseccomp if the seccomp policy does not use the SCMP_ACT_NOTIFY
action.

A new synchronization step between runc[INIT] and runc run is introduced
to pass the seccomp fd. runc run fetches the seccomp fd with pidfd_get
from the runc[INIT] process and sends it to the seccomp agent using
SCM_RIGHTS.

As suggested by @kolyshkin, we also make writeSync() a wrapper of
writeSyncWithFd() and wrap the error there. To avoid pointless errors,
we made some existing code paths just return the error instead of
re-wrapping it. If we don't do it, error will look like:

	writing syncT <act>: writing syncT: <err>

By adjusting the code path, now they just look like this
	writing syncT <act>: <err>

Signed-off-by: Alban Crequy <alban@kinvolk.io>
Signed-off-by: Rodrigo Campos <rodrigo@kinvolk.io>
Co-authored-by: Rodrigo Campos <rodrigo@kinvolk.io>

2021-09-07 13:04:24 +02:00

..

patchbpf

Implement Seccomp Notify

2021-09-07 13:04:24 +02:00

config.go

Implement Seccomp Notify

2021-09-07 13:04:24 +02:00

seccomp_linux.go

Implement Seccomp Notify

2021-09-07 13:04:24 +02:00

seccomp_unsupported.go

Implement Seccomp Notify

2021-09-07 13:04:24 +02:00