From 32be99569d279d3be3b77b29514b2c8747ae1b5b Mon Sep 17 00:00:00 2001 From: Etienne Perot Date: Mon, 27 Nov 2023 20:26:55 -0800 Subject: [PATCH] Add `GOARCH` as config key to seccomp filter options. This ensures that we cannot accidentally load rules that were compiled for one CPU architecture onto another architecture. With this change, if this happens, we'll ignore the precompiled rules and generate them at container startup instead. (Prior to this change, this could have happened for example if the `runsc` binary had been cross-compiled, with the rules generation binary compiled for a different architecture than the `runsc` target architecture.) PiperOrigin-RevId: 585835885 --- runsc/boot/filter/config/config.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/runsc/boot/filter/config/config.go b/runsc/boot/filter/config/config.go index da07eb606..e52b66d7b 100644 --- a/runsc/boot/filter/config/config.go +++ b/runsc/boot/filter/config/config.go @@ -19,6 +19,7 @@ package config import ( "fmt" "os" + "runtime" "strings" "golang.org/x/sys/unix" @@ -55,6 +56,7 @@ func isInstrumentationEnabled() bool { // at runtime (e.g. `ControllerFD`). func (opt Options) ConfigKey() string { var sb strings.Builder + sb.WriteString(fmt.Sprintf("GOARCH=%q ", runtime.GOARCH)) sb.WriteString(fmt.Sprintf("Platform=%q ", opt.Platform.ConfigKey())) sb.WriteString(fmt.Sprintf("HostNetwork=%t ", opt.HostNetwork)) sb.WriteString(fmt.Sprintf("HostNetworkRawSockets=%t ", opt.HostNetworkRawSockets))