Log seccomp from spec

Only log if OCI seccomp flag is enabled, otherwise the seccomp field
is ignored.

PiperOrigin-RevId: 504640124

runsc/boot/controller.go

@@ -293,7 +293,7 @@ func (cm *containerManager) StartSubcontainer(args *StartArgs, _ *struct{}) erro
 	}
 
 	// All validation passed, logs the spec for debugging.
-	specutils.LogSpec(args.Spec)
+	specutils.LogSpecDebug(args.Spec, args.Conf.OCISeccomp)
 
 	goferFiles := args.Files
 	var stdios []*fd.FD

runsc/cmd/boot.go

@@ -236,7 +236,7 @@ func (b *Boot) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomma
 	if err != nil {
 		util.Fatalf("reading spec: %v", err)
 	}
-	specutils.LogSpec(spec)
+	specutils.LogSpecDebug(spec, conf.OCISeccomp)
 
 	if b.applyCaps {
 		caps := spec.Process.Capabilities

runsc/cmd/checkpoint.go

@@ -123,7 +123,7 @@ func (c *Checkpoint) Execute(_ context.Context, f *flag.FlagSet, args ...any) su
 		util.Fatalf("reading spec: %v", err)
 	}
 
-	specutils.LogSpec(spec)
+	specutils.LogSpecDebug(spec, conf.OCISeccomp)
 
 	if cont.ConsoleSocket != "" {
 		log.Warningf("ignoring console socket since it cannot be restored")

runsc/cmd/create.go

@@ -96,7 +96,7 @@ func (c *Create) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcom
 	if err != nil {
 		return util.Errorf("reading spec: %v", err)
 	}
-	specutils.LogSpec(spec)
+	specutils.LogSpecDebug(spec, conf.OCISeccomp)
 
 	// Create the container. A new sandbox will be created for the
 	// container unless the metadata specifies that it should be run in an

runsc/cmd/do.go

@@ -403,7 +403,7 @@ func calculatePeerIP(ip string) (string, error) {
 }
 
 func startContainerAndWait(spec *specs.Spec, conf *config.Config, cid string, waitStatus *unix.WaitStatus) subcommands.ExitStatus {
-	specutils.LogSpec(spec)
+	specutils.LogSpecDebug(spec, conf.OCISeccomp)
 
 	out, err := json.Marshal(spec)
 	if err != nil {

runsc/cmd/gofer.go

@@ -205,7 +205,7 @@ func (g *Gofer) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomm
 		}
 	}()
 
-	specutils.LogSpec(spec)
+	specutils.LogSpecDebug(spec, conf.OCISeccomp)
 
 	// fsgofer should run with a umask of 0, because we want to preserve file
 	// modes exactly as sent by the sandbox, which will have applied its own umask.

runsc/cmd/restore.go

@@ -93,7 +93,7 @@ func (r *Restore) Execute(_ context.Context, f *flag.FlagSet, args ...any) subco
 	if err != nil {
 		return util.Errorf("reading spec: %v", err)
 	}
-	specutils.LogSpec(spec)
+	specutils.LogSpecDebug(spec, conf.OCISeccomp)
 
 	if r.imagePath == "" {
 		return util.Errorf("image-path flag must be provided")

runsc/cmd/run.go

@@ -87,7 +87,7 @@ func (r *Run) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomman
 	if err != nil {
 		return util.Errorf("reading spec: %v", err)
 	}
-	specutils.LogSpec(spec)
+	specutils.LogSpecDebug(spec, conf.OCISeccomp)
 
 	runArgs := container.Args{
 		ID:            id,

runsc/specutils/specutils.go

@@ -47,8 +47,8 @@ var ExePath = "/proc/self/exe"
 // Version is the supported spec version.
 var Version = specs.Version
 
-// LogSpec logs the spec in a human-friendly way.
-func LogSpec(orig *specs.Spec) {
+// LogSpecDebug writes the spec in a human-friendly format to the debug log.
+func LogSpecDebug(orig *specs.Spec, logSeccomp bool) {
 	if !log.IsLogging(log.Debug) {
 		return
 	}
@@ -59,7 +59,9 @@ func LogSpec(orig *specs.Spec) {
 		spec.Process.Capabilities = nil
 	}
 	if spec.Linux != nil {
-		spec.Linux.Seccomp = nil
+		if !logSeccomp {
+			spec.Linux.Seccomp = nil
+		}
 		spec.Linux.MaskedPaths = nil
 		spec.Linux.ReadonlyPaths = nil
 		if spec.Linux.Resources != nil {

test/runner/main.go

@@ -190,7 +190,7 @@ func runRunsc(tc *gtest.TestCase, spec *specs.Spec) error {
 	name := tc.FullName()
 	id := testutil.RandomContainerID()
 	log.Infof("Running test %q in container %q", name, id)
-	specutils.LogSpec(spec)
+	specutils.LogSpecDebug(spec, false)
 
 	args := []string{
 		"-root", rootDir,