seccomp

Documentation

Index

• func DefaultProfile() *seccomp.Seccomp
• type Config
  • func New() *Config
  • func (c *Config) IsDisabled() bool
  • func (c *Config) LoadDefaultProfile() error
  • func (c *Config) LoadProfile(profilePath string) error
  • func (c *Config) NotifierPath() string
  • func (c *Config) Profile() *seccomp.Seccomp
  • func (c *Config) SetNotifierPath(path string)
  • func (c *Config) Setup(ctx context.Context, sys *imagetypes.SystemContext, msgChan chan Notification, ...) (*Notifier, string, error)
• type Notification
  • func (n *Notification) ContainerID() string
  • func (n *Notification) Ctx() context.Context
  • func (n *Notification) Syscall() string
• type Notifier
  • func NewNotifier(ctx context.Context, msgChan chan Notification, ...) (*Notifier, error)
  • func (n *Notifier) AddSyscall(syscall string)
  • func (n *Notifier) Close() error
  • func (n *Notifier) OnExpired(callback func())
  • func (n *Notifier) StopContainers() bool
  • func (n *Notifier) UsedSyscalls() string

Functions

func DefaultProfile

func DefaultProfile() *seccomp.Seccomp

DefaultProfile is used to allow mutations from the DefaultProfile from the seccomp library. Specifically, it is used to filter syscalls which can create namespaces from the default profile, as it is risky for unprivileged containers to have access to create Linux namespaces.

Types

type Config

type Config struct {
	// contains filtered or unexported fields
}

Config is the global seccomp configuration type

func New

func New() *Config

New creates a new default seccomp configuration instance

func (*Config) IsDisabled

func (c *Config) IsDisabled() bool

IsDisabled returns true if seccomp is disabled either via the missing `seccomp` buildtag or globally by the system.

func (*Config) LoadDefaultProfile

func (c *Config) LoadDefaultProfile() error

LoadDefaultProfile sets the internal default profile.

func (*Config) LoadProfile

func (c *Config) LoadProfile(profilePath string) error

LoadProfile can be used to load a seccomp profile from the provided path. This method will not fail if seccomp is disabled.

func (*Config) NotifierPath

func (c *Config) NotifierPath() string

NotifierPath returns the currently used seccomp notifier base path.

func (*Config) Profile

func (c *Config) Profile() *seccomp.Seccomp

Profile returns the currently loaded seccomp profile

func (*Config) SetNotifierPath

func (c *Config) SetNotifierPath(path string)

SetNotifierPath sets the default path for creating seccomp notifier sockets.

func (*Config) Setup

func (c *Config) Setup(
	ctx context.Context,
	sys *imagetypes.SystemContext,
	msgChan chan Notification,
	containerID, containerName string,
	sandboxAnnotations, imageAnnotations map[string]string,
	specGenerator *generate.Generator,
	profileField *types.SecurityProfile,
) (*Notifier, string, error)

Setup can be used to setup the seccomp profile.

type Notification

type Notification struct {
	// contains filtered or unexported fields
}

Notification is a seccomp notification which gets sent to the CRI-O server.

func (*Notification) ContainerID

func (n *Notification) ContainerID() string

ContainerID returns the container identifier for the notification.

func (*Notification) Ctx

func (n *Notification) Ctx() context.Context

Ctx returns the context of the notification.

func (*Notification) Syscall

func (n *Notification) Syscall() string

Syscall returns the syscall name for the notification.

type Notifier

type Notifier struct {
	// contains filtered or unexported fields
}

Notifier wraps a seccomp notifier instance for a container.

func NewNotifier

func NewNotifier(
	ctx context.Context,
	msgChan chan Notification,
	containerID, listenerPath string,
	annotationMap map[string]string,
) (*Notifier, error)

NewNotifier starts the notifier for the provided arguments.

func (*Notifier) AddSyscall

func (n *Notifier) AddSyscall(syscall string)

AddSyscall can be used to add a syscall to the notifier result.

func (*Notifier) Close

func (n *Notifier) Close() error

Close can be used to close the notifier listener.

func (*Notifier) OnExpired

func (n *Notifier) OnExpired(callback func())

OnExpired calls the provided callback if the internal timer has been expired. It refreshes the timer for each call of this method.

func (*Notifier) StopContainers

func (n *Notifier) StopContainers() bool

StopContainers returns if the notifier should stop containers or not.

func (*Notifier) UsedSyscalls

func (n *Notifier) UsedSyscalls() string

UsedSyscalls returns a string representation of the used syscalls, sorted by their name.