From b4c64d11f166496a11717f035ff51b8dc7dca6a0 Mon Sep 17 00:00:00 2001 From: Fabricio Voznika Date: Wed, 25 Jan 2023 13:03:13 -0800 Subject: [PATCH] Log seccomp from spec Only log if OCI seccomp flag is enabled, otherwise the seccomp field is ignored. PiperOrigin-RevId: 504640124 --- runsc/boot/controller.go | 2 +- runsc/cmd/boot.go | 2 +- runsc/cmd/checkpoint.go | 2 +- runsc/cmd/create.go | 2 +- runsc/cmd/do.go | 2 +- runsc/cmd/gofer.go | 2 +- runsc/cmd/restore.go | 2 +- runsc/cmd/run.go | 2 +- runsc/specutils/specutils.go | 8 +++++--- test/runner/main.go | 2 +- 10 files changed, 14 insertions(+), 12 deletions(-) diff --git a/runsc/boot/controller.go b/runsc/boot/controller.go index 4435d3bba..7d5089add 100644 --- a/runsc/boot/controller.go +++ b/runsc/boot/controller.go @@ -293,7 +293,7 @@ func (cm *containerManager) StartSubcontainer(args *StartArgs, _ *struct{}) erro } // All validation passed, logs the spec for debugging. - specutils.LogSpec(args.Spec) + specutils.LogSpecDebug(args.Spec, args.Conf.OCISeccomp) goferFiles := args.Files var stdios []*fd.FD diff --git a/runsc/cmd/boot.go b/runsc/cmd/boot.go index f3c832855..7b144f0b8 100644 --- a/runsc/cmd/boot.go +++ b/runsc/cmd/boot.go @@ -236,7 +236,7 @@ func (b *Boot) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomma if err != nil { util.Fatalf("reading spec: %v", err) } - specutils.LogSpec(spec) + specutils.LogSpecDebug(spec, conf.OCISeccomp) if b.applyCaps { caps := spec.Process.Capabilities diff --git a/runsc/cmd/checkpoint.go b/runsc/cmd/checkpoint.go index 9b684c7ad..17de5f122 100644 --- a/runsc/cmd/checkpoint.go +++ b/runsc/cmd/checkpoint.go @@ -123,7 +123,7 @@ func (c *Checkpoint) Execute(_ context.Context, f *flag.FlagSet, args ...any) su util.Fatalf("reading spec: %v", err) } - specutils.LogSpec(spec) + specutils.LogSpecDebug(spec, conf.OCISeccomp) if cont.ConsoleSocket != "" { log.Warningf("ignoring console socket since it cannot be restored") diff --git a/runsc/cmd/create.go b/runsc/cmd/create.go index 3c8541b12..a1643ce25 100644 --- a/runsc/cmd/create.go +++ b/runsc/cmd/create.go @@ -96,7 +96,7 @@ func (c *Create) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcom if err != nil { return util.Errorf("reading spec: %v", err) } - specutils.LogSpec(spec) + specutils.LogSpecDebug(spec, conf.OCISeccomp) // Create the container. A new sandbox will be created for the // container unless the metadata specifies that it should be run in an diff --git a/runsc/cmd/do.go b/runsc/cmd/do.go index 75fa67574..8b10f6f25 100644 --- a/runsc/cmd/do.go +++ b/runsc/cmd/do.go @@ -403,7 +403,7 @@ func calculatePeerIP(ip string) (string, error) { } func startContainerAndWait(spec *specs.Spec, conf *config.Config, cid string, waitStatus *unix.WaitStatus) subcommands.ExitStatus { - specutils.LogSpec(spec) + specutils.LogSpecDebug(spec, conf.OCISeccomp) out, err := json.Marshal(spec) if err != nil { diff --git a/runsc/cmd/gofer.go b/runsc/cmd/gofer.go index e9409bb80..cd106f9bb 100644 --- a/runsc/cmd/gofer.go +++ b/runsc/cmd/gofer.go @@ -205,7 +205,7 @@ func (g *Gofer) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomm } }() - specutils.LogSpec(spec) + specutils.LogSpecDebug(spec, conf.OCISeccomp) // fsgofer should run with a umask of 0, because we want to preserve file // modes exactly as sent by the sandbox, which will have applied its own umask. diff --git a/runsc/cmd/restore.go b/runsc/cmd/restore.go index 5bab839f5..a58c3f865 100644 --- a/runsc/cmd/restore.go +++ b/runsc/cmd/restore.go @@ -93,7 +93,7 @@ func (r *Restore) Execute(_ context.Context, f *flag.FlagSet, args ...any) subco if err != nil { return util.Errorf("reading spec: %v", err) } - specutils.LogSpec(spec) + specutils.LogSpecDebug(spec, conf.OCISeccomp) if r.imagePath == "" { return util.Errorf("image-path flag must be provided") diff --git a/runsc/cmd/run.go b/runsc/cmd/run.go index 7f75c9b34..bbeb610b9 100644 --- a/runsc/cmd/run.go +++ b/runsc/cmd/run.go @@ -87,7 +87,7 @@ func (r *Run) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomman if err != nil { return util.Errorf("reading spec: %v", err) } - specutils.LogSpec(spec) + specutils.LogSpecDebug(spec, conf.OCISeccomp) runArgs := container.Args{ ID: id, diff --git a/runsc/specutils/specutils.go b/runsc/specutils/specutils.go index 2b0b9206a..a531adf9c 100644 --- a/runsc/specutils/specutils.go +++ b/runsc/specutils/specutils.go @@ -47,8 +47,8 @@ var ExePath = "/proc/self/exe" // Version is the supported spec version. var Version = specs.Version -// LogSpec logs the spec in a human-friendly way. -func LogSpec(orig *specs.Spec) { +// LogSpecDebug writes the spec in a human-friendly format to the debug log. +func LogSpecDebug(orig *specs.Spec, logSeccomp bool) { if !log.IsLogging(log.Debug) { return } @@ -59,7 +59,9 @@ func LogSpec(orig *specs.Spec) { spec.Process.Capabilities = nil } if spec.Linux != nil { - spec.Linux.Seccomp = nil + if !logSeccomp { + spec.Linux.Seccomp = nil + } spec.Linux.MaskedPaths = nil spec.Linux.ReadonlyPaths = nil if spec.Linux.Resources != nil { diff --git a/test/runner/main.go b/test/runner/main.go index 626d84137..685e19026 100644 --- a/test/runner/main.go +++ b/test/runner/main.go @@ -190,7 +190,7 @@ func runRunsc(tc *gtest.TestCase, spec *specs.Spec) error { name := tc.FullName() id := testutil.RandomContainerID() log.Infof("Running test %q in container %q", name, id) - specutils.LogSpec(spec) + specutils.LogSpecDebug(spec, false) args := []string{ "-root", rootDir,