github.com/inspektor-gadget/inspektor-gadget@v0.28.1/pkg/gadget-collection/gadgets/advise/seccomp/syscalls.go (about)

     1  //go:build !docs
     2  // +build !docs
     3  
     4  // Copyright 2019-2021 The Inspektor Gadget authors
     5  //
     6  // Licensed under the Apache License, Version 2.0 (the "License");
     7  // you may not use this file except in compliance with the License.
     8  // You may obtain a copy of the License at
     9  //
    10  //     http://www.apache.org/licenses/LICENSE-2.0
    11  //
    12  // Unless required by applicable law or agreed to in writing, software
    13  // distributed under the License is distributed on an "AS IS" BASIS,
    14  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    15  // See the License for the specific language governing permissions and
    16  // limitations under the License.
    17  
    18  package seccomp
    19  
    20  import (
    21  	commonseccomp "github.com/containers/common/pkg/seccomp"
    22  	"github.com/inspektor-gadget/inspektor-gadget/pkg/gadgets/advise/seccomp/tracer"
    23  	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    24  	seccompprofile "sigs.k8s.io/security-profiles-operator/api/seccompprofile/v1beta1"
    25  )
    26  
    27  func syscallNamesToSeccompPolicy(profileName *SeccompProfileNsName, syscallNames []string) *seccompprofile.SeccompProfile {
    28  	syscalls := []*seccompprofile.Syscall{
    29  		{
    30  			Names:  syscallNames,
    31  			Action: commonseccomp.ActAllow,
    32  			Args:   []*seccompprofile.Arg{},
    33  		},
    34  	}
    35  
    36  	ret := seccompprofile.SeccompProfile{
    37  		ObjectMeta: metav1.ObjectMeta{
    38  			Namespace:   profileName.namespace,
    39  			Annotations: map[string]string{},
    40  			Labels:      map[string]string{},
    41  		},
    42  		Spec: seccompprofile.SeccompProfileSpec{
    43  			BaseProfileName: "",
    44  			DefaultAction:   commonseccomp.ActErrno,
    45  			Architectures:   nil,
    46  			Syscalls:        syscalls,
    47  		},
    48  	}
    49  
    50  	if profileName.generateName {
    51  		ret.ObjectMeta.GenerateName = profileName.name + "-"
    52  	} else {
    53  		ret.ObjectMeta.Name = profileName.name
    54  	}
    55  
    56  	for _, a := range tracer.Arches() {
    57  		arch := seccompprofile.Arch(a)
    58  		ret.Spec.Architectures = append(ret.Spec.Architectures, arch)
    59  	}
    60  
    61  	return &ret
    62  }