Fix seccomp debugging tip to work with precompiled filters.

Changing the default action in `seccomp.Install` now does nothing,
because the rules are never instantiated when they are loaded from
a precompiled state.

Moving the debugging instructions to the `filter` package also makes
more sense for debugging the Sentry, as the `seccomp` package is also
used to install other seccomp rules which are not meant to have their
default action overwritten even when debugging.

PiperOrigin-RevId: 586538349

pkg/seccomp/seccomp.go

@@ -56,9 +56,8 @@ const (
 // syscall is still blocked from executing.
 func Install(rules SyscallRules, denyRules SyscallRules, options ProgramOptions) error {
 	// ***   DEBUG TIP   ***
-	// If you suspect the process is getting killed due to a seccomp violation, uncomment the line
-	// below to get a panic stack trace when there is a violation.
-	// options.DefaultAction = Return(linux.BPFAction(linux.SECCOMP_RET_TRAP))
+	// If you suspect the Sentry is getting killed due to a seccomp violation,
+	// look for the `debugFilter` boolean in `//runsc/boot/filter/filter.go`.
 
 	log.Infof("Installing seccomp filters for %d syscalls (action=%v)", rules.Size(), options.DefaultAction)
 

runsc/boot/filter/BUILD

@@ -26,6 +26,7 @@ go_library(
         "//runsc/boot:__subpackages__",
     ],
     deps = [
+        "//pkg/abi/linux",
         "//pkg/log",
         "//pkg/seccomp",
         "//pkg/seccomp/precompiledseccomp",

runsc/boot/filter/filter.go

@@ -19,11 +19,18 @@ package filter
 import (
 	"fmt"
 
+	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/seccomp"
 	"gvisor.dev/gvisor/runsc/boot/filter/config"
 )
 
+// ***   DEBUG TIP   ***
+// If you suspect the Sentry is getting killed due to a seccomp violation,
+// change this to `true` to get a panic stack trace when there is a
+// violation.
+const debugFilter = false
+
 // Options is a re-export of the config Options type under this package.
 type Options = config.Options
 
@@ -33,8 +40,8 @@ func Install(opt Options) error {
 		log.Warningf("*** SECCOMP WARNING: %s", warning)
 	}
 	key := opt.ConfigKey()
-	precompiled, found := GetPrecompiled(key)
-	if found {
+	precompiled, usePrecompiled := GetPrecompiled(key)
+	if usePrecompiled && !debugFilter {
 		vars := opt.Vars()
 		log.Debugf("Loaded precompiled seccomp instructions for options %v, using variables: %v", key, vars)
 		insns, err := precompiled.RenderInstructions(vars)
@@ -43,7 +50,13 @@ func Install(opt Options) error {
 		}
 		return seccomp.SetFilter(insns)
 	}
-	log.Infof("No precompiled program found for config options %v, building seccomp program from scratch. This may slow down container startup.", key)
+	seccompOpts := config.SeccompOptions(opt)
+	if debugFilter {
+		log.Infof("Seccomp filter debugging is enabled; seccomp failures will result in a panic stack trace.")
+		seccompOpts.DefaultAction = linux.SECCOMP_RET_TRAP
+	} else {
+		log.Infof("No precompiled program found for config options %v, building seccomp program from scratch. This may slow down container startup.", key)
+	}
 	rules, denyRules := config.Rules(opt)
-	return seccomp.Install(rules, denyRules, config.SeccompOptions(opt))
+	return seccomp.Install(rules, denyRules, seccompOpts)
 }