| 45 | namespace slave { |
| 46 | |
| 47 | Try<Isolator*> LinuxSeccompIsolatorProcess::create(const Flags& flags) |
| 48 | { |
| 49 | if (geteuid() != 0) { |
| 50 | return Error("Linux Seccomp isolator requires root permissions"); |
| 51 | } |
| 52 | |
| 53 | // Check if the kernel supports seccomp filter. |
| 54 | const int ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, nullptr); |
| 55 | if (!(ret == -1 && EFAULT == errno)) { |
| 56 | return Error("Seccomp is not supported by the kernel"); |
| 57 | } |
| 58 | |
| 59 | if (flags.seccomp_config_dir.isNone()) { |
| 60 | return Error("Missing required `--seccomp_config_dir` flag"); |
| 61 | } |
| 62 | |
| 63 | Option<ContainerSeccompProfile> defaultProfile; |
| 64 | |
| 65 | // Parse default Seccomp profile. |
| 66 | if (flags.seccomp_profile_name.isSome()) { |
| 67 | const auto path = path::join( |
| 68 | flags.seccomp_config_dir.get(), flags.seccomp_profile_name.get()); |
| 69 | |
| 70 | Try<ContainerSeccompProfile> profile = |
| 71 | mesos::internal::seccomp::parseProfile(path); |
| 72 | |
| 73 | if (profile.isError()) { |
| 74 | return Error(profile.error()); |
| 75 | } |
| 76 | |
| 77 | defaultProfile = profile.get(); |
| 78 | } |
| 79 | |
| 80 | return new MesosIsolator(Owned<MesosIsolatorProcess>( |
| 81 | new LinuxSeccompIsolatorProcess(flags, defaultProfile))); |
| 82 | } |
| 83 | |
| 84 | |
| 85 | bool LinuxSeccompIsolatorProcess::supportsNesting() { return true; } |