seccomp

Documentation

Index

• func DefaultProfile() *seccomp.Seccomp
• type Config
  • func New() *Config
  • func (c *Config) IsDisabled() bool
  • func (c *Config) LoadDefaultProfile() error
  • func (c *Config) LoadProfile(profilePath string) error
  • func (c *Config) NotifierPath() string
  • func (c *Config) Profile() *seccomp.Seccomp
  • func (c *Config) SetNotifierPath(path string)
  • func (c *Config) Setup(ctx context.Context, sys *imagetypes.SystemContext, msgChan chan Notification, ...) (*Notifier, string, error)
• type Notification
  • func (n *Notification) ContainerID() string
  • func (n *Notification) Ctx() context.Context
  • func (n *Notification) Syscall() string
• type Notifier
  • func NewNotifier(ctx context.Context, msgChan chan Notification, ...) (*Notifier, error)
  • func (n *Notifier) AddSyscall(syscall string)
  • func (n *Notifier) Close() error
  • func (n *Notifier) OnExpired(callback func())
  • func (n *Notifier) StopContainers() bool
  • func (n *Notifier) UsedSyscalls() string

Functions

func DefaultProfile

func DefaultProfile() *seccomp.Seccomp

DefaultProfile is used to allow mutations from the DefaultProfile from the seccomp library. Specifically, it is used to filter `unshare` from the default profile, as it is a risky syscall for unprivileged containers to have access to.

Types

type Config

type Config struct {
	// contains filtered or unexported fields
}

Config is the global seccomp configuration type

func New

func New() *Config

New creates a new default seccomp configuration instance

func (*Config) IsDisabled

func (c *Config) IsDisabled() bool

IsDisabled returns true if seccomp is disabled either via the missing `seccomp` buildtag or globally by the system.

func (*Config) LoadDefaultProfile

func (c *Config) LoadDefaultProfile() error

LoadDefaultProfile sets the internal default profile.

func (*Config) LoadProfile

func (c *Config) LoadProfile(profilePath string) error

LoadProfile can be used to load a seccomp profile from the provided path. This method will not fail if seccomp is disabled.

func (*Config) NotifierPath

func (c *Config) NotifierPath() string

NotifierPath returns the currently used seccomp notifier base path.

func (*Config) Profile

func (c *Config) Profile() *seccomp.Seccomp

Profile returns the currently loaded seccomp profile

func (*Config) SetNotifierPath

func (c *Config) SetNotifierPath(path string)

SetNotifierPath sets the default path for creating seccomp notifier sockets.

func (*Config) Setup

func (c *Config) Setup(
	ctx context.Context,
	sys *imagetypes.SystemContext,
	msgChan chan Notification,
	containerID, containerName string,
	sandboxAnnotations, imageAnnotations map[string]string,
	specGenerator *generate.Generator,
	profileField *types.SecurityProfile,
) (*Notifier, string, error)

Setup can be used to setup the seccomp profile.

type Notification

type Notification struct {
	// contains filtered or unexported fields
}

Notification is a seccomp notification which gets sent to the CRI-O server.

func (*Notification) ContainerID

func (n *Notification) ContainerID() string

ContainerID returns the container identifier for the notification.

func (*Notification) Ctx

func (n *Notification) Ctx() context.Context

Ctx returns the context of the notification.

func (*Notification) Syscall

func (n *Notification) Syscall() string

Syscall returns the syscall name for the notification.

type Notifier

type Notifier struct {
	// contains filtered or unexported fields
}

Notifier wraps a seccomp notifier instance for a container.

func NewNotifier

func NewNotifier(
	ctx context.Context,
	msgChan chan Notification,
	containerID, listenerPath string,
	annotationMap map[string]string,
) (*Notifier, error)

NewNotifier starts the notifier for the provided arguments.

func (*Notifier) AddSyscall

func (n *Notifier) AddSyscall(syscall string)

AddSyscall can be used to add a syscall to the notifier result.

func (*Notifier) Close

func (n *Notifier) Close() error

Close can be used to close the notifier listener.

func (*Notifier) OnExpired

func (n *Notifier) OnExpired(callback func())

OnExpired calls the provided callback if the internal timer has been expired. It refreshes the timer for each call of this method.

func (*Notifier) StopContainers

func (n *Notifier) StopContainers() bool

StopContainers returns if the notifier should stop containers or not.

func (*Notifier) UsedSyscalls

func (n *Notifier) UsedSyscalls() string

UsedSyscalls returns a string representation of the used syscalls, sorted by their name.