containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: disable seccomp by default when privileged. 

When running a privileged container and `SeccompProfilePath` is empty no seccomp profile should be applied.
(Previously this was the case only if `SeccompProfilePath` was set to a non-empty default path.)

Closes #8849

Signed-off-by: Max Goltzsche <max.goltzsche@gmail.com>
This commit is contained in:
Max Goltzsche 2021-01-02 00:20:10 +01:00
parent 39b1cb4967
commit bd35792b0c
No known key found for this signature in database
GPG Key ID: 364FA5A62B410BA4
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/specgen/generate/security.go
View File

@ -172,7 +172,7 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
// Clear default Seccomp profile from Generator for unconfined containers // Clear default Seccomp profile from Generator for unconfined containers
// and privileged containers which do not specify a seccomp profile. // and privileged containers which do not specify a seccomp profile.
if s.SeccompProfilePath == "unconfined" || (s.Privileged && (s.SeccompProfilePath == config.SeccompOverridePath || s.SeccompProfilePath == config.SeccompDefaultPath)) { if s.SeccompProfilePath == "unconfined" || (s.Privileged && (s.SeccompProfilePath == "" || s.SeccompProfilePath == config.SeccompOverridePath || s.SeccompProfilePath == config.SeccompDefaultPath)) {
configSpec.Linux.Seccomp = nil configSpec.Linux.Seccomp = nil
} }

9
test/e2e/run_privileged_test.go
View File

@ -110,6 +110,15 @@ var _ = Describe("Podman privileged container tests", func() {
Expect("0000000000000000").To(Equal(capEff[1])) Expect("0000000000000000").To(Equal(capEff[1]))
}) })
It("podman privileged should disable seccomp by default", func() {
hostSeccomp := SystemExec("grep", []string{"-Ei", "^Seccomp:\\s+0$", "/proc/self/status"})
Expect(hostSeccomp.ExitCode()).To(Equal(0))
session := podmanTest.Podman([]string{"run", "--privileged", ALPINE, "grep", "-Ei", "^Seccomp:\\s+0$", "/proc/self/status"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
})
It("podman non-privileged should have very few devices", func() { It("podman non-privileged should have very few devices", func() {
session := podmanTest.Podman([]string{"run", "-t", "busybox", "ls", "-l", "/dev"}) session := podmanTest.Podman([]string{"run", "-t", "busybox", "ls", "-l", "/dev"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()