seccomp

Documentation

Index

• func GetDefaultProfile(rs *specs.Spec) (*specs.LinuxSeccomp, error)
• func LoadProfile(body string, rs *specs.Spec) (*specs.LinuxSeccomp, error)
• type Architecture
• type Filter
• type KernelVersion
  • func (k *KernelVersion) MarshalJSON() ([]byte, error)
  • func (k *KernelVersion) String() string
  • func (k *KernelVersion) UnmarshalJSON(version []byte) error
• type Seccomp
  • func DefaultProfile() *Seccomp
• type Syscall

Functions

func GetDefaultProfile

func GetDefaultProfile(rs *specs.Spec) (*specs.LinuxSeccomp, error)

GetDefaultProfile returns the default seccomp profile.

func LoadProfile

func LoadProfile(body string, rs *specs.Spec) (*specs.LinuxSeccomp, error)

LoadProfile takes a json string and decodes the seccomp profile.

Types

type Architecture

type Architecture struct {
	Arch      specs.Arch   `json:"architecture"`
	SubArches []specs.Arch `json:"subArchitectures"`
}

Architecture is used to represent a specific architecture and its sub-architectures

type Filter

type Filter struct {
	Caps   []string `json:"caps,omitempty"`
	Arches []string `json:"arches,omitempty"`

	// MinKernel describes the minimum kernel version the rule must be applied
	// on, in the format "<kernel version>.<major revision>" (e.g. "3.12").
	//
	// When matching the kernel version of the host, minor revisions, and distro-
	// specific suffixes are ignored, which means that "3.12.25-gentoo", "3.12-1-amd64",
	// "3.12", and "3.12-rc5" are considered equal (kernel 3, major revision 12).
	MinKernel *KernelVersion `json:"minKernel,omitempty"`
}

Filter is used to conditionally apply Seccomp rules

type KernelVersion

type KernelVersion struct {
	Kernel uint64 // Version of the Kernel (i.e., the "4" in "4.1.2-generic")
	Major  uint64 // Major revision of the Kernel (i.e., the "1" in "4.1.2-generic")
}

KernelVersion holds information about the kernel.

func (*KernelVersion) MarshalJSON

func (k *KernelVersion) MarshalJSON() ([]byte, error)

MarshalJSON implements json.Unmarshaler for KernelVersion

func (*KernelVersion) String

func (k *KernelVersion) String() string

String implements fmt.Stringer for KernelVersion

func (*KernelVersion) UnmarshalJSON

func (k *KernelVersion) UnmarshalJSON(version []byte) error

UnmarshalJSON implements json.Marshaler for KernelVersion

type Seccomp

type Seccomp struct {
	DefaultAction specs.LinuxSeccompAction `json:"defaultAction"`
	// Architectures is kept to maintain backward compatibility with the old
	// seccomp profile.
	Architectures []specs.Arch   `json:"architectures,omitempty"`
	ArchMap       []Architecture `json:"archMap,omitempty"`
	Syscalls      []*Syscall     `json:"syscalls"`
}

Seccomp represents the config for a seccomp profile for syscall restriction.

func DefaultProfile

func DefaultProfile() *Seccomp

DefaultProfile returns a nil pointer on unsupported systems.

type Syscall

type Syscall struct {
	specs.LinuxSyscall
	// Deprecated: kept for backward compatibility with old JSON profiles, use Names instead
	Name     string  `json:"name,omitempty"`
	Comment  string  `json:"comment,omitempty"`
	Includes *Filter `json:"includes,omitempty"`
	Excludes *Filter `json:"excludes,omitempty"`
}

Syscall is used to match a group of syscalls in Seccomp. It extends the runtime-spec Syscall type, adding a "Name" field for backward compatibility with older JSON representations, additional "Comment" metadata, and conditional rules ("Includes", "Excludes") used to generate a runtime-spec Seccomp profile based on the container (capabilities) and host's (arch, kernel) configuration.