Kir Kolyshkin 19a9d9fc9e tests/int: use runc features in seccomp flags test ...

This test (initially added by commit 58ea21daef and later amended in
commit 26dc55ef1a) currently has two major deficiencies:

1. All possible flag combinations, and their respective numeric values,
   have to be explicitly listed. Currently we support 3 flags, so
   there is only 2^3 - 1 = 7 combinations, but adding more flags will
   become increasingly difficult (for example, 5 flags will result in
   31 combinations).

2. The test requires kernel 4.17 (for SECCOMP_FILTER_FLAG_SPEC_ALLOW),
   and not doing any tests when running on an older kernel. This, too,
   will make it more difficult to add extra flags in the future.

Both issues can be solved by using runc features which now prints all
known and supported runc flags. We still have to hardcode the numeric
values of all flags, but most of the other work is coded now.

In particular:

 * The test only uses supported flags, meaning it can be used with
   older kernels, removing the limitation (2) above.

 * The test calculates the powerset (all possible combinations) of
   flags and their numeric values. This makes it easier to add more
   flags, removing the limitation (1) above.

 * The test will fail (in flags_value) if any new flags will be added
   to runc but the test itself is not amended.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2022-11-29 17:24:32 -08:00

..

patchbpf

runc features: add seccomp filter flags

2022-11-29 17:24:32 -08:00

config.go

runc features: add seccomp filter flags

2022-11-29 17:24:32 -08:00

seccomp_linux.go

tests/int: use runc features in seccomp flags test

2022-11-29 17:24:32 -08:00

seccomp_unsupported.go

runc features: add seccomp filter flags

2022-11-29 17:24:32 -08:00