| 87 | |
| 88 | |
| 89 | Future<Option<ContainerLaunchInfo>> LinuxSeccompIsolatorProcess::prepare( |
| 90 | const ContainerID& containerId, |
| 91 | const ContainerConfig& containerConfig) |
| 92 | { |
| 93 | Option<ContainerSeccompProfile> profile = defaultProfile; |
| 94 | |
| 95 | std::string profileName = |
| 96 | flags.seccomp_profile_name.isSome() ? flags.seccomp_profile_name.get() : ""; |
| 97 | |
| 98 | // Framework can override default Seccomp profile for a particular container. |
| 99 | if (containerConfig.has_container_info() && |
| 100 | containerConfig.container_info().has_linux_info() && |
| 101 | containerConfig.container_info().linux_info().has_seccomp()) { |
| 102 | const auto& seccomp = |
| 103 | containerConfig.container_info().linux_info().seccomp(); |
| 104 | |
| 105 | const bool unconfined = |
| 106 | seccomp.has_unconfined() ? seccomp.unconfined() : false; |
| 107 | |
| 108 | // Validate Seccomp configuration. |
| 109 | if (unconfined && seccomp.has_profile_name()) { |
| 110 | return Failure( |
| 111 | "Invalid Seccomp configuration: 'profile_name' given even " |
| 112 | "though 'unconfined' Seccomp setting is enabled"); |
| 113 | } |
| 114 | |
| 115 | if (seccomp.has_profile_name()) { |
| 116 | profileName = seccomp.profile_name(); |
| 117 | const auto path = path::join(flags.seccomp_config_dir.get(), profileName); |
| 118 | |
| 119 | Try<ContainerSeccompProfile> customProfile = |
| 120 | mesos::internal::seccomp::parseProfile(path); |
| 121 | |
| 122 | if (customProfile.isError()) { |
| 123 | return Failure(customProfile.error()); |
| 124 | } |
| 125 | |
| 126 | profile = customProfile.get(); |
| 127 | } else if (unconfined) { |
| 128 | LOG(INFO) << "Seccomp is not applied to container " << containerId; |
| 129 | |
| 130 | return None(); |
| 131 | } else { |
| 132 | return Failure("Missing Seccomp profile name"); |
| 133 | } |
| 134 | } |
| 135 | |
| 136 | if (profile.isNone()) { |
| 137 | return None(); |
| 138 | } |
| 139 | |
| 140 | ContainerLaunchInfo launchInfo; |
| 141 | launchInfo.mutable_seccomp_profile()->CopyFrom(profile.get()); |
| 142 | |
| 143 | LOG(INFO) << "Using Seccomp profile '" << profileName |
| 144 | << "' for container " << containerId; |
| 145 | |
| 146 | return launchInfo; |