You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by gi...@apache.org on 2019/01/28 07:52:38 UTC
[mesos] 07/11: Added `linux/seccomp` isolator.
This is an automated email from the ASF dual-hosted git repository.
gilbert pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit f26e51c4e9ffd6d24feafe793185c56bdf34c1bc
Author: Andrei Budnik <ab...@mesosphere.com>
AuthorDate: Sun Jan 27 23:52:01 2019 -0800
Added `linux/seccomp` isolator.
This patch introduces `linux/seccomp` isolator which is used for
preparing `ContainerSeccompProfile` for the Mesos containerizer
launcher. If the `ContainerConfig` message has an info about Seccomp
profile name, then this info will be used to locate a Seccomp profile.
The given Seccomp profile is parsed and the resulting
`ContainerSeccompProfile` is stored in the `ContainerLaunchInfo`
message.
Review: https://reviews.apache.org/r/68021/
---
src/CMakeLists.txt | 3 +-
src/Makefile.am | 4 +-
src/slave/containerizer/mesos/containerizer.cpp | 8 ++
.../mesos/isolators/linux/seccomp.cpp | 125 +++++++++++++++++++++
.../mesos/isolators/linux/seccomp.hpp | 57 ++++++++++
5 files changed, 195 insertions(+), 2 deletions(-)
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 7cd92fb..1564183 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -345,7 +345,8 @@ endif()
if (ENABLE_SECCOMP_ISOLATOR)
list(APPEND LINUX_SRC
linux/seccomp/seccomp.cpp
- linux/seccomp/seccomp_parser.cpp)
+ linux/seccomp/seccomp_parser.cpp
+ slave/containerizer/mesos/isolators/linux/seccomp.cpp)
endif ()
set(LOCAL_SRC
diff --git a/src/Makefile.am b/src/Makefile.am
index 2e263f6..46e943e 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -1426,7 +1426,9 @@ MESOS_LINUX_FILES += \
linux/seccomp/seccomp.cpp \
linux/seccomp/seccomp.hpp \
linux/seccomp/seccomp_parser.cpp \
- linux/seccomp/seccomp_parser.hpp
+ linux/seccomp/seccomp_parser.hpp \
+ slave/containerizer/mesos/isolators/linux/seccomp.cpp \
+ slave/containerizer/mesos/isolators/linux/seccomp.hpp
endif
if ENABLE_LINUX_ROUTING
diff --git a/src/slave/containerizer/mesos/containerizer.cpp b/src/slave/containerizer/mesos/containerizer.cpp
index 5016f2e..35f51ad 100644
--- a/src/slave/containerizer/mesos/containerizer.cpp
+++ b/src/slave/containerizer/mesos/containerizer.cpp
@@ -110,6 +110,10 @@
#include "slave/containerizer/mesos/isolators/volume/secret.hpp"
#endif // __linux__
+#if ENABLE_SECCOMP_ISOLATOR
+#include "slave/containerizer/mesos/isolators/linux/seccomp.hpp"
+#endif
+
#ifdef ENABLE_PORT_MAPPING_ISOLATOR
#include "slave/containerizer/mesos/isolators/network/port_mapping.hpp"
#endif
@@ -440,6 +444,10 @@ Try<MesosContainerizer*> MesosContainerizer::create(
{"disk/xfs", &XfsDiskIsolatorProcess::create},
#endif // ENABLE_XFS_DISK_ISOLATOR
+#if ENABLE_SECCOMP_ISOLATOR
+ {"linux/seccomp", &LinuxSeccompIsolatorProcess::create},
+#endif // ENABLE_SECCOMP_ISOLATOR
+
// GPU isolators.
#ifdef __linux__
diff --git a/src/slave/containerizer/mesos/isolators/linux/seccomp.cpp b/src/slave/containerizer/mesos/isolators/linux/seccomp.cpp
new file mode 100644
index 0000000..1c94e12
--- /dev/null
+++ b/src/slave/containerizer/mesos/isolators/linux/seccomp.cpp
@@ -0,0 +1,125 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <linux/seccomp.h>
+
+#include <sys/prctl.h>
+
+#include <stout/path.hpp>
+
+#include "linux/seccomp/seccomp_parser.hpp"
+
+#include "slave/containerizer/mesos/isolators/linux/seccomp.hpp"
+
+using process::Failure;
+using process::Future;
+using process::Owned;
+
+using mesos::seccomp::ContainerSeccompProfile;
+
+using mesos::slave::ContainerConfig;
+using mesos::slave::ContainerLaunchInfo;
+using mesos::slave::Isolator;
+
+namespace mesos {
+namespace internal {
+namespace slave {
+
+Try<Isolator*> LinuxSeccompIsolatorProcess::create(const Flags& flags)
+{
+ if (geteuid() != 0) {
+ return Error("Linux Seccomp isolator requires root permissions");
+ }
+
+ // Check if the kernel supports seccomp filter.
+ const int ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, nullptr);
+ if (!(ret == -1 && EFAULT == errno)) {
+ return Error("Seccomp is not supported by the kernel");
+ }
+
+ if (flags.seccomp_config_dir.isNone()) {
+ return Error("Missing required `--seccomp_config_dir` flag");
+ }
+
+ Option<ContainerSeccompProfile> defaultProfile;
+
+ // Parse default Seccomp profile.
+ if (flags.seccomp_profile_name.isSome()) {
+ const auto path = path::join(
+ flags.seccomp_config_dir.get(), flags.seccomp_profile_name.get());
+
+ Try<ContainerSeccompProfile> profile =
+ mesos::internal::seccomp::parseProfile(path);
+
+ if (profile.isError()) {
+ return Error(profile.error());
+ }
+
+ defaultProfile = profile.get();
+ }
+
+ return new MesosIsolator(Owned<MesosIsolatorProcess>(
+ new LinuxSeccompIsolatorProcess(flags, defaultProfile)));
+}
+
+
+bool LinuxSeccompIsolatorProcess::supportsNesting() { return true; }
+bool LinuxSeccompIsolatorProcess::supportsStandalone() { return true; }
+
+
+Future<Option<ContainerLaunchInfo>> LinuxSeccompIsolatorProcess::prepare(
+ const ContainerID& containerId,
+ const ContainerConfig& containerConfig)
+{
+ Option<ContainerSeccompProfile> profile = defaultProfile;
+
+ // Framework can override default Seccomp profile for a particular container.
+ if (containerConfig.has_container_info() &&
+ containerConfig.container_info().has_linux_info() &&
+ containerConfig.container_info().linux_info().has_seccomp()) {
+ const auto& seccomp =
+ containerConfig.container_info().linux_info().seccomp();
+
+ if (seccomp.has_profile_name()) {
+ const auto path =
+ path::join(flags.seccomp_config_dir.get(), seccomp.profile_name());
+
+ Try<ContainerSeccompProfile> customProfile =
+ mesos::internal::seccomp::parseProfile(path);
+
+ if (customProfile.isError()) {
+ return Failure(customProfile.error());
+ }
+
+ profile = customProfile.get();
+ } else {
+ return Failure("Missing Seccomp profile name");
+ }
+ }
+
+ if (profile.isNone()) {
+ return None();
+ }
+
+ ContainerLaunchInfo launchInfo;
+ launchInfo.mutable_seccomp_profile()->CopyFrom(profile.get());
+
+ return launchInfo;
+}
+
+} // namespace slave {
+} // namespace internal {
+} // namespace mesos {
diff --git a/src/slave/containerizer/mesos/isolators/linux/seccomp.hpp b/src/slave/containerizer/mesos/isolators/linux/seccomp.hpp
new file mode 100644
index 0000000..d385f5e
--- /dev/null
+++ b/src/slave/containerizer/mesos/isolators/linux/seccomp.hpp
@@ -0,0 +1,57 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef __LINUX_SECCOMP_ISOLATOR_HPP__
+#define __LINUX_SECCOMP_ISOLATOR_HPP__
+
+#include <stout/option.hpp>
+#include <stout/try.hpp>
+
+#include "slave/flags.hpp"
+
+#include "slave/containerizer/mesos/isolator.hpp"
+
+namespace mesos {
+namespace internal {
+namespace slave {
+
+class LinuxSeccompIsolatorProcess : public MesosIsolatorProcess
+{
+public:
+ static Try<mesos::slave::Isolator*> create(const Flags& flags);
+
+ bool supportsNesting() override;
+ bool supportsStandalone() override;
+
+ process::Future<Option<mesos::slave::ContainerLaunchInfo>> prepare(
+ const ContainerID& containerId,
+ const mesos::slave::ContainerConfig& containerConfig) override;
+
+private:
+ LinuxSeccompIsolatorProcess(
+ const Flags& _flags,
+ const Option<mesos::seccomp::ContainerSeccompProfile>& _defaultProfile)
+ : flags(_flags), defaultProfile(_defaultProfile) {}
+
+ const Flags flags;
+ const Option<mesos::seccomp::ContainerSeccompProfile> defaultProfile;
+};
+
+} // namespace slave {
+} // namespace internal {
+} // namespace mesos {
+
+#endif // __LINUX_SECCOMP_ISOLATOR_HPP__