seccomp

Documentation

Index

• func CallForkmknod(c Instance, dev deviceConfig.Device, requestPID int, s *state.State) int
• func CreateProfile(s *state.State, c Instance) error
• func DeleteProfile(c Instance)
• func InstanceNeedsIntercept(s *state.State, c Instance) (bool, error)
• func InstanceNeedsPolicy(c Instance) bool
• func MakePidFd(pid int, s *state.State) (int, *os.File)
• func MountSyscallFilter(config map[string]string) []string
• func ProfilePath(c Instance) string
• func SyscallInterceptMountFilter(config map[string]string) (map[string]string, error)
• func TaskIDs(pid int) (int64, int64, int64, int64, error)
• type Instance
• type Iovec
  • func NewSeccompIovec(ucred *unix.Ucred) *Iovec
  • func (siov *Iovec) IsValidSeccompIovec(size uint64) bool
  • func (siov *Iovec) PutSeccompIovec()
  • func (siov *Iovec) ReceiveSeccompIovec(fd int) (uint64, error)
  • func (siov *Iovec) SendSeccompIovec(fd int, errno int, flags uint32) error
• type MknodArgs
• type MountArgs
• type Server
  • func NewSeccompServer(s *state.State, path string, ...) (*Server, error)
  • func (s *Server) HandleBpfSyscall(c Instance, siov *Iovec) int
  • func (s *Server) HandleInvalid(fd int, siov *Iovec)
  • func (s *Server) HandleMknodSyscall(c Instance, siov *Iovec) int
  • func (s *Server) HandleMknodatSyscall(c Instance, siov *Iovec) int
  • func (s *Server) HandleMountSyscall(c Instance, siov *Iovec) int
  • func (s *Server) HandleSetxattrSyscall(c Instance, siov *Iovec) int
  • func (s *Server) HandleValid(fd int, siov *Iovec, ...) error
  • func (s *Server) MountSyscallShift(c Instance) bool
  • func (s *Server) MountSyscallValid(c Instance, args *MountArgs) (bool, string)
  • func (s *Server) Stop() error
• type SetxattrArgs

Functions

func CallForkmknod

func CallForkmknod(c Instance, dev deviceConfig.Device, requestPID int, s *state.State) int

CallForkmknod executes fork mknod.

func CreateProfile

func CreateProfile(s *state.State, c Instance) error

CreateProfile creates a seccomp profile.

func DeleteProfile

func DeleteProfile(c Instance)

DeleteProfile removes a seccomp profile.

func InstanceNeedsIntercept

func InstanceNeedsIntercept(s *state.State, c Instance) (bool, error)

InstanceNeedsIntercept returns whether instance needs intercept.

func InstanceNeedsPolicy

func InstanceNeedsPolicy(c Instance) bool

InstanceNeedsPolicy returns whether the instance needs a policy or not.

func MakePidFd

func MakePidFd(pid int, s *state.State) (int, *os.File)

MakePidFd prepares a pidfd to inherit for the init process of the container.

func MountSyscallFilter

func MountSyscallFilter(config map[string]string) []string

MountSyscallFilter creates a mount syscall filter from the config.

func ProfilePath

func ProfilePath(c Instance) string

ProfilePath returns the seccomp path for the instance.

func SyscallInterceptMountFilter

func SyscallInterceptMountFilter(config map[string]string) (map[string]string, error)

SyscallInterceptMountFilter creates a new mount syscall interception filter

func TaskIDs

func TaskIDs(pid int) (int64, int64, int64, int64, error)

TaskIDs returns the task IDs for a process.

Types

type Instance

type Instance interface {
	Name() string
	Project() string
	ExpandedConfig() map[string]string
	IsPrivileged() bool
	Architecture() int
	RootfsPath() string
	CurrentIdmap() (*idmap.IdmapSet, error)
	DiskIdmap() (*idmap.IdmapSet, error)
	InsertSeccompUnixDevice(prefix string, m deviceConfig.Device, pid int) error
}

Instance is a seccomp specific instance interface. This is used rather than instance.Instance to avoid import loops.

type Iovec

type Iovec struct {
	// contains filtered or unexported fields
}

Iovec defines an iovec to move data between kernel and userspace.

func NewSeccompIovec

func NewSeccompIovec(ucred *unix.Ucred) *Iovec

NewSeccompIovec creates a new seccomp iovec.

func (*Iovec) IsValidSeccompIovec

func (siov *Iovec) IsValidSeccompIovec(size uint64) bool

IsValidSeccompIovec checks whether a seccomp iovec is valid.

func (*Iovec) PutSeccompIovec

func (siov *Iovec) PutSeccompIovec()

PutSeccompIovec puts a seccomp iovec.

func (*Iovec) ReceiveSeccompIovec

func (siov *Iovec) ReceiveSeccompIovec(fd int) (uint64, error)

ReceiveSeccompIovec receives a seccomp iovec.

func (*Iovec) SendSeccompIovec

func (siov *Iovec) SendSeccompIovec(fd int, errno int, flags uint32) error

SendSeccompIovec sends seccomp iovec.

type MknodArgs

type MknodArgs struct {
	// contains filtered or unexported fields
}

MknodArgs arguments for mknod.

type MountArgs

type MountArgs struct {
	// contains filtered or unexported fields
}

MountArgs arguments for mount.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server defines a seccomp server.

func NewSeccompServer

func NewSeccompServer(s *state.State, path string, findPID func(pid int32, state *state.State) (Instance, error)) (*Server, error)

NewSeccompServer creates a new seccomp server.

func (*Server) HandleBpfSyscall

func (s *Server) HandleBpfSyscall(c Instance, siov *Iovec) int

HandleBpfSyscall handles mount syscalls.

func (*Server) HandleInvalid

func (s *Server) HandleInvalid(fd int, siov *Iovec)

HandleInvalid sends a dummy message to LXC. LXC will notice the short write and send a default message to the kernel thereby avoiding a 30s hang.

func (*Server) HandleMknodSyscall

func (s *Server) HandleMknodSyscall(c Instance, siov *Iovec) int

HandleMknodSyscall handles a mknod syscall.

func (*Server) HandleMknodatSyscall

func (s *Server) HandleMknodatSyscall(c Instance, siov *Iovec) int

HandleMknodatSyscall handles a mknodat syscall.

func (*Server) HandleMountSyscall

func (s *Server) HandleMountSyscall(c Instance, siov *Iovec) int

HandleMountSyscall handles mount syscalls.

func (*Server) HandleSetxattrSyscall

func (s *Server) HandleSetxattrSyscall(c Instance, siov *Iovec) int

HandleSetxattrSyscall handles setxattr syscalls.

func (*Server) HandleValid

func (s *Server) HandleValid(fd int, siov *Iovec, findPID func(pid int32, state *state.State) (Instance, error)) error

HandleValid handles a valid seccomp notifier message.

func (*Server) MountSyscallShift

func (s *Server) MountSyscallShift(c Instance) bool

MountSyscallShift checks whether this mount syscall needs shiftfs.

func (*Server) MountSyscallValid

func (s *Server) MountSyscallValid(c Instance, args *MountArgs) (bool, string)

MountSyscallValid checks whether this is a mount syscall we intercept.

func (*Server) Stop

func (s *Server) Stop() error

Stop stops a seccomp server.

type SetxattrArgs

type SetxattrArgs struct {
	// contains filtered or unexported fields
}

SetxattrArgs arguments for setxattr.