From 0d69ca6637b30a3370529b3e272f27f6fafdb0c3 Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@redhat.com>
Date: Wed, 17 Jan 2018 11:03:07 -0500
Subject: Fix seccomp support

If user does not specify seccomp file or seccomp file does not exist,
then use the default seccomp settings.

Still need to not hard code /etc/crio/seccomp.json, should move this to
/usr/share/seccomp/seccomp.json

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #233
Approved by: baude
---
 cmd/podman/spec.go | 40 +++++++++++++++++++++++++---------------
 1 file changed, 25 insertions(+), 15 deletions(-)

(limited to 'cmd/podman/spec.go')

diff --git a/cmd/podman/spec.go b/cmd/podman/spec.go
index df1c54d50..59ea5685a 100644
--- a/cmd/podman/spec.go
+++ b/cmd/podman/spec.go
@@ -1,13 +1,13 @@
 package main
 
 import (
-	"encoding/json"
 	"io/ioutil"
 	"strings"
 
 	"github.com/cri-o/ocicni/pkg/ocicni"
 	"github.com/docker/docker/daemon/caps"
 	"github.com/docker/docker/pkg/mount"
+	"github.com/docker/docker/profiles/seccomp"
 	"github.com/docker/go-units"
 	"github.com/opencontainers/runc/libcontainer/devices"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
@@ -290,16 +290,31 @@ func createConfigToOCISpec(config *createConfig) (*spec.Spec, error) {
 	}
 	configSpec := g.Spec()
 
-	if config.SeccompProfilePath != "" && config.SeccompProfilePath != "unconfined" {
-		seccompProfile, err := ioutil.ReadFile(config.SeccompProfilePath)
-		if err != nil {
-			return nil, errors.Wrapf(err, "opening seccomp profile (%s) failed", config.SeccompProfilePath)
-		}
-		var seccompConfig spec.LinuxSeccomp
-		if err := json.Unmarshal(seccompProfile, &seccompConfig); err != nil {
-			return nil, errors.Wrapf(err, "decoding seccomp profile (%s) failed", config.SeccompProfilePath)
+	// HANDLE CAPABILITIES
+	// NOTE: Must happen before SECCOMP
+	if err := setupCapabilities(config, configSpec); err != nil {
+		return nil, err
+	}
+
+	// HANDLE SECCOMP
+	if config.SeccompProfilePath != "unconfined" {
+		if config.SeccompProfilePath != "" {
+			seccompProfile, err := ioutil.ReadFile(config.SeccompProfilePath)
+			if err != nil {
+				return nil, errors.Wrapf(err, "opening seccomp profile (%s) failed", config.SeccompProfilePath)
+			}
+			seccompConfig, err := seccomp.LoadProfile(string(seccompProfile), configSpec)
+			if err != nil {
+				return nil, errors.Wrapf(err, "loading seccomp profile (%s) failed", config.SeccompProfilePath)
+			}
+			configSpec.Linux.Seccomp = seccompConfig
+		} else {
+			seccompConfig, err := seccomp.GetDefaultProfile(configSpec)
+			if err != nil {
+				return nil, errors.Wrapf(err, "loading seccomp profile (%s) failed", config.SeccompProfilePath)
+			}
+			configSpec.Linux.Seccomp = seccompConfig
 		}
-		configSpec.Linux.Seccomp = &seccompConfig
 	}
 
 	// BIND MOUNTS
@@ -319,11 +334,6 @@ func createConfigToOCISpec(config *createConfig) (*spec.Spec, error) {
 		}
 	}
 
-	// HANDLE CAPABILITIES
-	if err := setupCapabilities(config, configSpec); err != nil {
-		return nil, err
-	}
-
 	// BLOCK IO
 	blkio, err := config.CreateBlockIO()
 	if err != nil {
-- 
cgit v1.2.3-54-g00ecf