runc/contrib/cmd/seccompagent

Seccomp Agent

Warning

Please note this is an example agent, as such it is possible that specially crafted messages can produce bad behaviour. Please use it as an example only.

Also, this agent is used for integration tests. Be aware that changing the behaviour can break the integration tests.

Get started

Compile runc and seccompagent:

make all

Run the seccomp agent in the background:

sudo ./contrib/cmd/seccompagent/seccompagent &

Prepare a container:

mkdir container-seccomp-notify
cd container-seccomp-notify
mkdir rootfs
docker export $(docker create busybox) | tar -C rootfs -xvf -

Copy the example config.json file from the directory where this README.md is to the container directory you prepared earlier (container-seccomp-notify). This is a config.json as generated by runc spec at time of writing, with only the args and seccomp sections modified.

Then start the container:

runc run mycontainerid

The container will output something like this:

+ cd /dev/shm
+ mkdir test-dir
+ touch test-file
+ chmod 777 test-file
chmod: changing permissions of 'test-file': No medium found
+ ls -l /dev/shm
total 0
drwxr-xr-x 2 root root 40 Jul 21 14:09 test-dir-foo
-rw-r--r-- 1 root root  0 Jul 21 14:09 test-file
+ echo Note the agent added a suffix for the directory name and chmod fails
Note the agent added a suffix for the directory name and chmod fails

This shows a simple example that runs in /dev/shm just because it is a tmpfs in the example config.json.

The agent makes all chmod calls fail with ENOMEDIUM, as the example output shows.

For mkdir, the agent adds a "-foo" suffix: the container runs "mkdir test-dir" but the directory created is "test-dir-foo".