In the default seccomp rule, allow use of 32 bit syscalls on
64 bit architectures, so you can run x86 Linux images on x86_64
without disabling seccomp or using a custom rule.
Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
| ... | ... |
@@ -6,10 +6,36 @@ import ( |
| 6 | 6 |
"syscall" |
| 7 | 7 |
|
| 8 | 8 |
"github.com/opencontainers/runc/libcontainer/configs" |
| 9 |
+ libseccomp "github.com/seccomp/libseccomp-golang" |
|
| 9 | 10 |
) |
| 10 | 11 |
|
| 12 |
+func arches() []string {
|
|
| 13 |
+ var native, err = libseccomp.GetNativeArch() |
|
| 14 |
+ if err != nil {
|
|
| 15 |
+ return []string{}
|
|
| 16 |
+ } |
|
| 17 |
+ var a = native.String() |
|
| 18 |
+ switch a {
|
|
| 19 |
+ case "amd64": |
|
| 20 |
+ return []string{"amd64", "x86"}
|
|
| 21 |
+ case "arm64": |
|
| 22 |
+ return []string{"arm64", "arm"}
|
|
| 23 |
+ case "mips64": |
|
| 24 |
+ return []string{"mips64", "mips64n32", "mips"}
|
|
| 25 |
+ case "mips64n32": |
|
| 26 |
+ return []string{"mips64", "mips64n32", "mips"}
|
|
| 27 |
+ case "mipsel64": |
|
| 28 |
+ return []string{"mipsel64", "mipsel64n32", "mipsel"}
|
|
| 29 |
+ case "mipsel64n32": |
|
| 30 |
+ return []string{"mipsel64", "mipsel64n32", "mipsel"}
|
|
| 31 |
+ default: |
|
| 32 |
+ return []string{a}
|
|
| 33 |
+ } |
|
| 34 |
+} |
|
| 35 |
+ |
|
| 11 | 36 |
var defaultSeccompProfile = &configs.Seccomp{
|
| 12 | 37 |
DefaultAction: configs.Errno, |
| 38 |
+ Architectures: arches(), |
|
| 13 | 39 |
Syscalls: []*configs.Syscall{
|
| 14 | 40 |
{
|
| 15 | 41 |
Name: "accept", |