podman

1
//go:build linux && !remote
2

3
package generate
4

5
import (
6
	"context"
7
	"errors"
8
	"fmt"
9
	"os"
10

11
	"github.com/containers/common/libimage"
12
	goSeccomp "github.com/containers/common/pkg/seccomp"
13
	"github.com/containers/podman/v5/pkg/seccomp"
14
	"github.com/containers/podman/v5/pkg/specgen"
15
	spec "github.com/opencontainers/runtime-spec/specs-go"
16
	"github.com/sirupsen/logrus"
17
)
18

19
func getSeccompConfig(s *specgen.SpecGenerator, configSpec *spec.Spec, img *libimage.Image) (*spec.LinuxSeccomp, error) {
20
	var seccompConfig *spec.LinuxSeccomp
21
	var err error
22
	scp, err := seccomp.LookupPolicy(s.SeccompPolicy)
23
	if err != nil {
24
		return nil, err
25
	}
26

27
	if scp == seccomp.PolicyImage {
28
		if img == nil {
29
			return nil, errors.New("cannot read seccomp profile without a valid image")
30
		}
31
		labels, err := img.Labels(context.Background())
32
		if err != nil {
33
			return nil, err
34
		}
35
		imagePolicy := labels[seccomp.ContainerImageLabel]
36
		if len(imagePolicy) < 1 {
37
			return nil, errors.New("no seccomp policy defined by image")
38
		}
39
		logrus.Debug("Loading seccomp profile from the security config")
40
		seccompConfig, err = goSeccomp.LoadProfile(imagePolicy, configSpec)
41
		if err != nil {
42
			return nil, fmt.Errorf("loading seccomp profile failed: %w", err)
43
		}
44
		return seccompConfig, nil
45
	}
46

47
	if s.SeccompProfilePath != "" {
48
		logrus.Debugf("Loading seccomp profile from %q", s.SeccompProfilePath)
49
		seccompProfile, err := os.ReadFile(s.SeccompProfilePath)
50
		if err != nil {
51
			return nil, fmt.Errorf("opening seccomp profile failed: %w", err)
52
		}
53
		seccompConfig, err = goSeccomp.LoadProfile(string(seccompProfile), configSpec)
54
		if err != nil {
55
			return nil, fmt.Errorf("loading seccomp profile (%s) failed: %w", s.SeccompProfilePath, err)
56
		}
57
	} else {
58
		logrus.Debug("Loading default seccomp profile")
59
		seccompConfig, err = goSeccomp.GetDefaultProfile(configSpec)
60
		if err != nil {
61
			return nil, fmt.Errorf("loading seccomp profile (%s) failed: %w", s.SeccompProfilePath, err)
62
		}
63
	}
64

65
	return seccompConfig, nil
66
}
67