github.com/akerouanton/docker@v1.11.0-rc3/profiles/seccomp/seccomp.go (about)

     1  // +build linux
     2  
     3  package seccomp
     4  
     5  import (
     6  	"encoding/json"
     7  	"fmt"
     8  
     9  	"github.com/docker/engine-api/types"
    10  	"github.com/opencontainers/specs/specs-go"
    11  )
    12  
    13  //go:generate go run -tags 'seccomp' generate.go
    14  
    15  // GetDefaultProfile returns the default seccomp profile.
    16  func GetDefaultProfile() (*specs.Seccomp, error) {
    17  	return setupSeccomp(DefaultProfile)
    18  }
    19  
    20  // LoadProfile takes a file path and decodes the seccomp profile.
    21  func LoadProfile(body string) (*specs.Seccomp, error) {
    22  	var config types.Seccomp
    23  	if err := json.Unmarshal([]byte(body), &config); err != nil {
    24  		return nil, fmt.Errorf("Decoding seccomp profile failed: %v", err)
    25  	}
    26  
    27  	return setupSeccomp(&config)
    28  }
    29  
    30  func setupSeccomp(config *types.Seccomp) (newConfig *specs.Seccomp, err error) {
    31  	if config == nil {
    32  		return nil, nil
    33  	}
    34  
    35  	// No default action specified, no syscalls listed, assume seccomp disabled
    36  	if config.DefaultAction == "" && len(config.Syscalls) == 0 {
    37  		return nil, nil
    38  	}
    39  
    40  	newConfig = &specs.Seccomp{}
    41  
    42  	// if config.Architectures == 0 then libseccomp will figure out the architecture to use
    43  	if len(config.Architectures) > 0 {
    44  		for _, arch := range config.Architectures {
    45  			newConfig.Architectures = append(newConfig.Architectures, specs.Arch(arch))
    46  		}
    47  	}
    48  
    49  	newConfig.DefaultAction = specs.Action(config.DefaultAction)
    50  
    51  	// Loop through all syscall blocks and convert them to libcontainer format
    52  	for _, call := range config.Syscalls {
    53  		newCall := specs.Syscall{
    54  			Name:   call.Name,
    55  			Action: specs.Action(call.Action),
    56  		}
    57  
    58  		// Loop through all the arguments of the syscall and convert them
    59  		for _, arg := range call.Args {
    60  			newArg := specs.Arg{
    61  				Index:    arg.Index,
    62  				Value:    arg.Value,
    63  				ValueTwo: arg.ValueTwo,
    64  				Op:       specs.Operator(arg.Op),
    65  			}
    66  
    67  			newCall.Args = append(newCall.Args, newArg)
    68  		}
    69  
    70  		newConfig.Syscalls = append(newConfig.Syscalls, newCall)
    71  	}
    72  
    73  	return newConfig, nil
    74  }