Browse code

Remove "seccomp" build tag

Similar to the (now removed) `apparmor` build tag, this build-time toggle existed for users who needed to build without the `libseccomp` library. That's no longer necessary, and given the importance of seccomp to the overall default security profile of Docker containers, it makes sense that any binary built for Linux should support (and use by default) seccomp if the underlying host does.

Signed-off-by: Tianon Gravi <admwiggin@gmail.com>

Tianon Gravi authored on 2021/06/10 03:52:10
Showing 11 changed files
... ...
@@ -5,7 +5,6 @@ ARG SYSTEMD="false"
5 5
 ARG GO_VERSION=1.18.2
6 6
 ARG DEBIAN_FRONTEND=noninteractive
7 7
 ARG VPNKIT_VERSION=0.5.0
8
-ARG DOCKER_BUILDTAGS="apparmor seccomp"
9 8
 
10 9
 ARG BASE_DEBIAN_DISTRO="bullseye"
11 10
 ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"
12 11
deleted file mode 100644
... ...
@@ -1,26 +0,0 @@
1
-//go:build linux && !seccomp
2
-// +build linux,!seccomp
3
-
4
-package daemon // import "github.com/docker/docker/daemon"
5
-
6
-import (
7
-	"context"
8
-	"fmt"
9
-
10
-	"github.com/containerd/containerd/containers"
11
-	coci "github.com/containerd/containerd/oci"
12
-	"github.com/docker/docker/container"
13
-	dconfig "github.com/docker/docker/daemon/config"
14
-)
15
-
16
-const supportsSeccomp = false
17
-
18
-// WithSeccomp sets the seccomp profile
19
-func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {
20
-	return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
21
-		if c.SeccompProfile != "" && c.SeccompProfile != dconfig.SeccompProfileUnconfined {
22
-			return fmt.Errorf("seccomp profiles are not supported on this daemon, you cannot specify a custom seccomp profile")
23
-		}
24
-		return nil
25
-	}
26
-}
... ...
@@ -1,6 +1,3 @@
1
-//go:build linux && seccomp
2
-// +build linux,seccomp
3
-
4 1
 package daemon // import "github.com/docker/docker/daemon"
5 2
 
6 3
 import (
... ...
@@ -1,6 +1,3 @@
1
-//go:build linux && seccomp
2
-// +build linux,seccomp
3
-
4 1
 package daemon // import "github.com/docker/docker/daemon"
5 2
 
6 3
 import (
... ...
@@ -12,7 +12,7 @@
12 12
 #
13 13
 set -eux -o pipefail
14 14
 
15
-BUILDFLAGS=(-tags 'netgo seccomp libdm_no_deferred_remove')
15
+BUILDFLAGS=(-tags 'netgo libdm_no_deferred_remove')
16 16
 TESTFLAGS+=" -test.timeout=${TIMEOUT:-5m}"
17 17
 TESTDIRS="${TESTDIRS:-./...}"
18 18
 exclude_paths='/vendor/|/integration'
... ...
@@ -62,7 +62,7 @@ func cgroupCpuset() bool {
62 62
 }
63 63
 
64 64
 func seccompEnabled() bool {
65
-	return supportsSeccomp && SysInfo.Seccomp
65
+	return SysInfo.Seccomp
66 66
 }
67 67
 
68 68
 func bridgeNfIptables() bool {
69 69
deleted file mode 100644
... ...
@@ -1,9 +0,0 @@
1
-//go:build !seccomp
2
-// +build !seccomp
3
-
4
-package main
5
-
6
-const (
7
-	// indicates docker daemon built with seccomp support
8
-	supportsSeccomp = false
9
-)
10 1
deleted file mode 100644
... ...
@@ -1,9 +0,0 @@
1
-//go:build seccomp
2
-// +build seccomp
3
-
4
-package main
5
-
6
-const (
7
-	// indicates docker daemon built with seccomp support
8
-	supportsSeccomp = true
9
-)
... ...
@@ -1,6 +1,3 @@
1
-//go:build seccomp
2
-// +build seccomp
3
-
4 1
 package seccomp // import "github.com/docker/docker/profiles/seccomp"
5 2
 
6 3
 import (
7 4
deleted file mode 100644
... ...
@@ -1,9 +0,0 @@
1
-//go:build linux && !seccomp
2
-// +build linux,!seccomp
3
-
4
-package seccomp // import "github.com/docker/docker/profiles/seccomp"
5
-
6
-// DefaultProfile returns a nil pointer on unsupported systems.
7
-func DefaultProfile() *Seccomp {
8
-	return nil
9
-}
... ...
@@ -81,14 +81,8 @@ Please use our build script ("./hack/make.sh") for compilation.
81 81
 
82 82
 ### `DOCKER_BUILDTAGS`
83 83
 
84
-If you're building a binary that might be used on platforms that include
85
-seccomp, you will need to use the `seccomp` build tag:
86
-```bash
87
-export DOCKER_BUILDTAGS='seccomp'
88
-```
89
-
90
-There are build tags for disabling graphdrivers as well. By default, support
91
-for all graphdrivers are built in.
84
+There are build tags for disabling graphdrivers, if necessary. By default,
85
+support for all graphdrivers are built in.
92 86
 
93 87
 To disable btrfs:
94 88
 ```bash
... ...
@@ -107,7 +101,7 @@ export DOCKER_BUILDTAGS='exclude_graphdriver_aufs'
107 107
 
108 108
 NOTE: if you need to set more than one build tag, space separate them:
109 109
 ```bash
110
-export DOCKER_BUILDTAGS='apparmor exclude_graphdriver_aufs'
110
+export DOCKER_BUILDTAGS='exclude_graphdriver_aufs exclude_graphdriver_btrfs'
111 111
 ```
112 112
 
113 113
 ## System Dependencies