Kir Kolyshkin 5dd92fd9b4 libct/seccomp: skip redundant rules ...

This fixes using runc with podman on my system (Fedora 34).

> $ podman --runtime `pwd`/runc run --rm --memory 4M fedora echo it works
> Error: unable to start container process: error adding seccomp filter rule for syscall bdflush: permission denied: OCI permission denied

The problem is, libseccomp returns EPERM when a redundant rule (i.e. the
rule with the same action as the default one) is added, and podman (on
my machine) sets the following rules in config.json:

    <....>
    "seccomp": {
      "defaultAction": "SCMP_ACT_ERRNO",
      "architectures": [
        "SCMP_ARCH_X86_64",
        "SCMP_ARCH_X86",
        "SCMP_ARCH_X32"
      ],
      "syscalls": [
        {
          "names": [
            "bdflush",
            "io_pgetevents",
            <....>
          ],
          "action": "SCMP_ACT_ERRNO",
          "errnoRet": 1
        },
        <....>

(Note that defaultErrnoRet is not set, but it defaults to 1).

With this commit, it works:

> $ podman --runtime `pwd`/runc run --memory 4M fedora echo it works
> it works

Add an integration test (that fails without the fix).

Similar crun commit:
 * https://github.com/containers/crun/commit/08229f3fb904c5ea19a7d9

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2021-07-27 00:04:59 -07:00

..

patchbpf

*: stop using pkg/errors

2021-06-22 16:09:47 -07:00

config.go

libct/seccomp: ConvertStringToAction: fix doc

2021-07-27 00:04:59 -07:00

seccomp_linux.go

libct/seccomp: skip redundant rules

2021-07-27 00:04:59 -07:00

seccomp_unsupported.go

libct/seccomp: rm IsEnabled

2021-03-23 16:59:46 -07:00