Skip to content

Commit f60597b

Browse files
saschagrunertsaschagrunert
authored
Merge pull request cri-o#6120 from saschagrunert/seccomp-notifier
Add seccomp notifier feature
2 parents c4a9c6d + 3b63124 commit f60597b

File tree

23 files changed

+906
-120
lines changed

23 files changed

+906
-120
lines changed

‎docs/crio.8.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -290,7 +290,7 @@ crio [GLOBAL OPTIONS] command [COMMAND OPTIONS] [ARGUMENTS...]
290290

291291
**--metrics-cert**="": Certificate for the secure metrics endpoint.
292292

293-
**--metrics-collectors**="": Enabled metrics collectors. (default: "operations", "operations_latency_microseconds_total", "operations_latency_microseconds", "operations_errors", "image_pulls_by_digest", "image_pulls_by_name", "image_pulls_by_name_skipped", "image_pulls_failures", "image_pulls_successes", "image_pulls_layer_size", "image_layer_reuse", "containers_oom_total", "containers_oom", "processes_defunct", "operations_total", "operations_latency_seconds", "operations_latency_seconds_total", "operations_errors_total", "image_pulls_bytes_total", "image_pulls_skipped_bytes_total", "image_pulls_failure_total", "image_pulls_success_total", "image_layer_reuse_total", "containers_oom_count_total")
293+
**--metrics-collectors**="": Enabled metrics collectors. (default: "operations", "operations_latency_microseconds_total", "operations_latency_microseconds", "operations_errors", "image_pulls_by_digest", "image_pulls_by_name", "image_pulls_by_name_skipped", "image_pulls_failures", "image_pulls_successes", "image_pulls_layer_size", "image_layer_reuse", "containers_oom_total", "containers_oom", "processes_defunct", "operations_total", "operations_latency_seconds", "operations_latency_seconds_total", "operations_errors_total", "image_pulls_bytes_total", "image_pulls_skipped_bytes_total", "image_pulls_failure_total", "image_pulls_success_total", "image_layer_reuse_total", "containers_oom_count_total", "containers_seccomp_notifier_count_total")
294294

295295
**--metrics-key**="": Certificate key for the secure metrics endpoint.
296296

‎docs/crio.conf.5.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,34 @@ A workload is chosen for a pod based on whether the workload's **activation_anno
337337
"io.kubernetes.cri-o.ShmSize" for configuring the size of /dev/shm.
338338
"io.kubernetes.cri-o.UnifiedCgroup.$CTR_NAME" for configuring the cgroup v2 unified block for a container.
339339
"io.containers.trace-syscall" for tracing syscalls via the OCI seccomp BPF hook.
340+
"io.kubernetes.cri-o.seccompNotifierAction" for enabling the seccomp notifier feature.
341+
342+
#### Using the seccomp notifier feature:
343+
344+
This feature can help you to debug seccomp related issues, for example if
345+
blocked syscalls (permission denied errors) have negative impact on the
346+
workload.
347+
348+
To be able to use this feature, configure a runtime which has the annotation
349+
"io.kubernetes.cri-o.seccompNotifierAction" in the `allowed_annotations` array.
350+
351+
It also requires at least runc 1.1.0 or crun 0.19 which support the notifier
352+
feature.
353+
354+
If everything is setup, CRI-O will modify chosen seccomp profiles for containers
355+
if the annotation "io.kubernetes.cri-o.seccompNotifierAction" is set on the Pod
356+
sandbox. CRI-O will then get notified if a container is using a blocked syscall
357+
and then terminate the workload after a timeout of 5 seconds if the value of
358+
"io.kubernetes.cri-o.seccompNotifierAction=stop".
359+
360+
This also means that multiple syscalls can be captured during that period, while
361+
the timeout will get reset once a new syscall has been discovered.
362+
363+
This also means that the Pods "restartPolicy" has to be set to "Never",
364+
otherwise the kubelet will restart the container immediately.
365+
366+
Please be aware that CRI-O is not able to get notified if a syscall gets blocked
367+
based on the seccomp defaultAction, which is a general runtime limitation.
340368

341369
### CRIO.RUNTIME.WORKLOAD.RESOURCES TABLE
342370
The resources table is a structure for overriding certain resources for pods using this workload.

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ require (
5555
github.com/opencontainers/selinux v1.10.2
5656
github.com/prometheus/client_golang v1.13.0
5757
github.com/psampaz/go-mod-outdated v0.8.0
58+
github.com/seccomp/libseccomp-golang v0.10.0
5859
github.com/sirupsen/logrus v1.9.0
5960
github.com/soheilhy/cmux v0.1.5
6061
github.com/stretchr/testify v1.8.0
@@ -301,7 +302,6 @@ require (
301302
github.com/russross/blackfriday/v2 v2.1.0 // indirect
302303
github.com/saschagrunert/go-modiff v1.3.0 // indirect
303304
github.com/sassoftware/relic v0.0.0-20210427151427-dfb082b79b74 // indirect
304-
github.com/seccomp/libseccomp-golang v0.10.0 // indirect
305305
github.com/secure-systems-lab/go-securesystemslib v0.4.0 // indirect
306306
github.com/segmentio/ksuid v1.0.4 // indirect
307307
github.com/sergi/go-diff v1.2.0 // indirect

0 commit comments

Comments
 (0)