Browse code

Support compatible architectures with default seccomp rules

In the default seccomp rule, allow use of 32 bit syscalls on
64 bit architectures, so you can run x86 Linux images on x86_64
without disabling seccomp or using a custom rule.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>

Justin Cormack authored on 2016/01/05 23:27:32
Showing 1 changed files
... ...
@@ -6,10 +6,36 @@ import (
6 6
 	"syscall"
7 7
 
8 8
 	"github.com/opencontainers/runc/libcontainer/configs"
9
+	libseccomp "github.com/seccomp/libseccomp-golang"
9 10
 )
10 11
 
12
+func arches() []string {
13
+	var native, err = libseccomp.GetNativeArch()
14
+	if err != nil {
15
+		return []string{}
16
+	}
17
+	var a = native.String()
18
+	switch a {
19
+	case "amd64":
20
+		return []string{"amd64", "x86"}
21
+	case "arm64":
22
+		return []string{"arm64", "arm"}
23
+	case "mips64":
24
+		return []string{"mips64", "mips64n32", "mips"}
25
+	case "mips64n32":
26
+		return []string{"mips64", "mips64n32", "mips"}
27
+	case "mipsel64":
28
+		return []string{"mipsel64", "mipsel64n32", "mipsel"}
29
+	case "mipsel64n32":
30
+		return []string{"mipsel64", "mipsel64n32", "mipsel"}
31
+	default:
32
+		return []string{a}
33
+	}
34
+}
35
+
11 36
 var defaultSeccompProfile = &configs.Seccomp{
12 37
 	DefaultAction: configs.Errno,
38
+	Architectures: arches(),
13 39
 	Syscalls: []*configs.Syscall{
14 40
 		{
15 41
 			Name:   "accept",