containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4948 from vrothberg/seccomp-label 

seccomp policy: expect profile in config label
This commit is contained in:
OpenShift Merge Robot 2020-01-23 07:31:11 -08:00 committed by GitHub
parent 6518421f89 1531509542
commit 8beeb067aa
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cmd/podman/shared/create.go
View File

@ -31,9 +31,9 @@ import (
"github.com/sirupsen/logrus" "github.com/sirupsen/logrus"
) )
// seccompAnnotationKey is the key of the image annotation embedding a seccomp // seccompLabelKey is the key of the image annotation embedding a seccomp
// profile. // profile.
const seccompAnnotationKey = "io.containers.seccomp.profile" const seccompLabelKey = "io.containers.seccomp.profile"
func CreateContainer(ctx context.Context, c *GenericCLIResults, runtime *libpod.Runtime) (*libpod.Container, *cc.CreateConfig, error) { func CreateContainer(ctx context.Context, c *GenericCLIResults, runtime *libpod.Runtime) (*libpod.Container, *cc.CreateConfig, error) {
var ( var (
@ -709,7 +709,7 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.
// SECCOMP // SECCOMP
if data != nil { if data != nil {
if value, exists := data.Annotations[seccompAnnotationKey]; exists { if value, exists := labels[seccompLabelKey]; exists {
secConfig.SeccompProfileFromImage = value secConfig.SeccompProfileFromImage = value
} }
} }

2
docs/source/markdown/podman-create.1.md
View File

@ -679,7 +679,7 @@ of the container is assumed to be managed externally.
**--seccomp-policy**=*policy* **--seccomp-policy**=*policy*
Specify the policy to select the seccomp profile. If set to *image*, Podman will look for a "io.podman.seccomp.profile" annotation in the container image and use its value as a seccomp profile. Otherwise, Podman will follow the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. Specify the policy to select the seccomp profile. If set to *image*, Podman will look for a "io.podman.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman will follow the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below.
Note that this feature is experimental and may change in the future. Note that this feature is experimental and may change in the future.

2
docs/source/markdown/podman-run.1.md
View File

@ -700,7 +700,7 @@ Note: On `SELinux` systems, the rootfs needs the correct label, which is by defa
**--seccomp-policy**=*policy* **--seccomp-policy**=*policy*
Specify the policy to select the seccomp profile. If set to *image*, Podman will look for a "io.podman.seccomp.profile" annotation in the container image and use its value as a seccomp profile. Otherwise, Podman will follow the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. Specify the policy to select the seccomp profile. If set to *image*, Podman will look for a "io.podman.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman will follow the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below.
Note that this feature is experimental and may change in the future. Note that this feature is experimental and may change in the future.

4
test/e2e/config.go
View File

@ -19,8 +19,8 @@ var (
// The intention behind blocking all syscalls is to prevent // The intention behind blocking all syscalls is to prevent
// regressions in the future. The required syscalls can vary // regressions in the future. The required syscalls can vary
// depending on which runtime we're using. // depending on which runtime we're using.
alpineSeccomp = "docker.io/libpod/alpine-with-seccomp:latest" alpineSeccomp = "docker.io/libpod/alpine-with-seccomp:label"
// This image has a bogus/invalid seccomp profile which should // This image has a bogus/invalid seccomp profile which should
// yield a json error when being read. // yield a json error when being read.
alpineBogusSeccomp = "docker.io/libpod/alpine-with-bogus-seccomp:latest" alpineBogusSeccomp = "docker.io/libpod/alpine-with-bogus-seccomp:label"
) )