summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2020-03-26 18:51:45 +0100
committerGitHub <noreply@github.com>2020-03-26 18:51:45 +0100
commite2cab552de969a5e2c276f8db97d6491f6c09b3e (patch)
treef60830302e5ae96b0ed612de71129fce4f537fd6
parent4f38509b6c8366e1093968833e2342b5b65311c5 (diff)
parentf8ccd7685882cd71be42d5a40e4ce09d88b0ebbd (diff)
downloadpodman-e2cab552de969a5e2c276f8db97d6491f6c09b3e.tar.gz
podman-e2cab552de969a5e2c276f8db97d6491f6c09b3e.tar.bz2
podman-e2cab552de969a5e2c276f8db97d6491f6c09b3e.zip
Merge pull request #5624 from giuseppe/use-slirp4netns-seccomp
slirp: enable seccomp filter
-rw-r--r--libpod/networking_linux.go33
1 files changed, 24 insertions, 9 deletions
diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go
index f1bf79ce7..a7f501bfe 100644
--- a/libpod/networking_linux.go
+++ b/libpod/networking_linux.go
@@ -154,13 +154,25 @@ func (r *Runtime) createNetNS(ctr *Container) (n ns.NetNS, q []*cnitypes.Result,
return ctrNS, networkStatus, err
}
-func checkSlirpFlags(path string) (bool, bool, bool, error) {
+type slirpFeatures struct {
+ HasDisableHostLoopback bool
+ HasMTU bool
+ HasEnableSandbox bool
+ HasEnableSeccomp bool
+}
+
+func checkSlirpFlags(path string) (*slirpFeatures, error) {
cmd := exec.Command(path, "--help")
out, err := cmd.CombinedOutput()
if err != nil {
- return false, false, false, errors.Wrapf(err, "slirp4netns %q", out)
- }
- return strings.Contains(string(out), "--disable-host-loopback"), strings.Contains(string(out), "--mtu"), strings.Contains(string(out), "--enable-sandbox"), nil
+ return nil, errors.Wrapf(err, "slirp4netns %q", out)
+ }
+ return &slirpFeatures{
+ HasDisableHostLoopback: strings.Contains(string(out), "--disable-host-loopback"),
+ HasMTU: strings.Contains(string(out), "--mtu"),
+ HasEnableSandbox: strings.Contains(string(out), "--enable-sandbox"),
+ HasEnableSeccomp: strings.Contains(string(out), "--enable-seccomp"),
+ }, nil
}
// Configure the network namespace for a rootless container
@@ -187,19 +199,22 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) (err error) {
logPath := filepath.Join(ctr.runtime.config.TmpDir, fmt.Sprintf("slirp4netns-%s.log", ctr.config.ID))
cmdArgs := []string{}
- dhp, mtu, sandbox, err := checkSlirpFlags(path)
+ slirpFeatures, err := checkSlirpFlags(path)
if err != nil {
return errors.Wrapf(err, "error checking slirp4netns binary %s: %q", path, err)
}
- if dhp {
+ if slirpFeatures.HasDisableHostLoopback {
cmdArgs = append(cmdArgs, "--disable-host-loopback")
}
- if mtu {
+ if slirpFeatures.HasMTU {
cmdArgs = append(cmdArgs, "--mtu", "65520")
}
- if sandbox {
+ if slirpFeatures.HasEnableSandbox {
cmdArgs = append(cmdArgs, "--enable-sandbox")
}
+ if slirpFeatures.HasEnableSeccomp {
+ cmdArgs = append(cmdArgs, "--enable-seccomp")
+ }
// the slirp4netns arguments being passed are describes as follows:
// from the slirp4netns documentation: https://github.com/rootless-containers/slirp4netns
@@ -230,7 +245,7 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) (err error) {
}
// workaround for https://github.com/rootless-containers/slirp4netns/pull/153
- if sandbox {
+ if slirpFeatures.HasEnableSandbox {
cmd.SysProcAttr.Cloneflags = syscall.CLONE_NEWNS
cmd.SysProcAttr.Unshareflags = syscall.CLONE_NEWNS
}