github.com/ssdev-go/moby@v17.12.1-ce-rc2+incompatible/daemon/seccomp_linux.go (about) 1 // +build linux,seccomp 2 3 package daemon 4 5 import ( 6 "fmt" 7 8 "github.com/docker/docker/container" 9 "github.com/docker/docker/profiles/seccomp" 10 "github.com/opencontainers/runtime-spec/specs-go" 11 "github.com/sirupsen/logrus" 12 ) 13 14 var supportsSeccomp = true 15 16 func setSeccomp(daemon *Daemon, rs *specs.Spec, c *container.Container) error { 17 var profile *specs.LinuxSeccomp 18 var err error 19 20 if c.HostConfig.Privileged { 21 return nil 22 } 23 24 if !daemon.seccompEnabled { 25 if c.SeccompProfile != "" && c.SeccompProfile != "unconfined" { 26 return fmt.Errorf("Seccomp is not enabled in your kernel, cannot run a custom seccomp profile.") 27 } 28 logrus.Warn("Seccomp is not enabled in your kernel, running container without default profile.") 29 c.SeccompProfile = "unconfined" 30 } 31 if c.SeccompProfile == "unconfined" { 32 return nil 33 } 34 if c.SeccompProfile != "" { 35 profile, err = seccomp.LoadProfile(c.SeccompProfile, rs) 36 if err != nil { 37 return err 38 } 39 } else { 40 if daemon.seccompProfile != nil { 41 profile, err = seccomp.LoadProfile(string(daemon.seccompProfile), rs) 42 if err != nil { 43 return err 44 } 45 } else { 46 profile, err = seccomp.GetDefaultProfile(rs) 47 if err != nil { 48 return err 49 } 50 } 51 } 52 53 rs.Linux.Seccomp = profile 54 return nil 55 }