Skip to content

Commit

Permalink
Seccomp: Provide custom policy
Browse files Browse the repository at this point in the history 
The initial policy is default policy
from containers/common + we allow userfaultfd
as the syscall is needed for post-copy

Signed-off-by: L. Pivarc <[email protected]>
  • Loading branch information
@xpivarc
xpivarc committed Jan 21, 2023
1 parent b79d01f commit 9f1bdd7
Show file tree
Hide file tree
Showing 532 changed files with 51,566 additions and 8,513 deletions.
1 change: 1 addition & 0 deletions cmd/virt-handler/BUILD.bazel
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ go_library(
"//pkg/virt-handler/node-labeller:go_default_library",
"//pkg/virt-handler/node-labeller/api:go_default_library",
"//pkg/virt-handler/rest:go_default_library",
"//pkg/virt-handler/seccomp:go_default_library",
"//pkg/virt-handler/selinux:go_default_library",
"//pkg/virt-handler/vsock:go_default_library",
"//pkg/virt-launcher/virtwrap/api:go_default_library",
Expand Down
25 changes: 24 additions & 1 deletion cmd/virt-handler/virt-handler.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ import (
"time"

kvtls "kubevirt.io/kubevirt/pkg/util/tls"
"kubevirt.io/kubevirt/pkg/virt-handler/seccomp"
"kubevirt.io/kubevirt/pkg/virt-handler/vsock"

"github.com/emicklei/go-restful"
Expand Down Expand Up @@ -137,6 +138,7 @@ type virtHandlerApp struct {
VirtPrivateDir string
VirtLibDir string
KubeletPodsDir string
KubeletRoot string
WatchdogTimeoutDuration time.Duration
MaxDevices int
MaxRequestsInFlight int
Expand Down Expand Up @@ -308,6 +310,7 @@ func (app *virtHandlerApp) Run() {
// set log verbosity
app.clusterConfig.SetConfigModifiedCallback(app.shouldChangeLogVerbosity)
app.clusterConfig.SetConfigModifiedCallback(app.shouldChangeRateLimiter)
app.clusterConfig.SetConfigModifiedCallback(app.shouldInstallKubevirtSeccompProfile)
app.clusterConfig.SetConfigModifiedCallback(app.shouldInstallSELinuxPolicy)

if err := app.setupTLS(factory); err != nil {
Expand Down Expand Up @@ -419,7 +422,7 @@ func (app *virtHandlerApp) Run() {
panic(fmt.Errorf("failed to detect the presence of selinux: %v", err))
}

cache.WaitForCacheSync(stop, vmiSourceInformer.HasSynced, factory.CRD().HasSynced)
cache.WaitForCacheSync(stop, vmiSourceInformer.HasSynced, factory.CRD().HasSynced, factory.KubeVirt().HasSynced)

go vmController.Run(10, stop)

Expand Down Expand Up @@ -519,6 +522,23 @@ func (app *virtHandlerApp) shouldInstallSELinuxPolicy() {
}
}

// Update virt-handler rate limiter
func (app *virtHandlerApp) shouldInstallKubevirtSeccompProfile() {
enabled := app.clusterConfig.KubevirtSeccompProfileEnabled()
if !enabled {
log.DefaultLogger().Info("Kubevirt Seccomp profile is not enabled")
return
}

installPath := filepath.Join("/proc/1/root", app.KubeletRoot)
if err := seccomp.InstallPolicy(installPath); err != nil {
log.DefaultLogger().Errorf("Failed to install Kubevirt Seccomp profile, %v", err)
return
}
log.DefaultLogger().Infof("Kubevirt Seccomp profile was installed at %s", installPath)

}

func (app *virtHandlerApp) runPrometheusServer(errCh chan error) {
mux := restful.NewContainer()
webService := new(restful.WebService)
Expand Down Expand Up @@ -592,6 +612,9 @@ func (app *virtHandlerApp) AddFlags() {
flag.StringVar(&app.KubeletPodsDir, "kubelet-pods-dir", util.KubeletPodsDir,
"Path for pod directory (matching host's path for kubelet root)")

flag.StringVar(&app.KubeletRoot, "kubelet-root", util.KubeletRoot,
"Path for Kubelet root")

flag.StringVar(&app.caConfigMapName, "ca-configmap-name", defaultCAConfigMapName,
"The name of configmap containing CA certificates to authenticate requests presenting client certificates with matching CommonName")

Expand Down
55 changes: 29 additions & 26 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,13 @@ require (
github.com/blang/semver v3.5.1+incompatible
github.com/c9s/goprocinfo v0.0.0-20210130143923-c95fcf8c64a8
github.com/cheggaaa/pb/v3 v3.1.0
github.com/containernetworking/plugins v0.9.1
github.com/containernetworking/plugins v1.1.1
github.com/coreos/go-semver v0.3.0
github.com/coreos/prometheus-operator v0.38.1-0.20200424145508-7e176fda06cc
github.com/emicklei/go-restful v2.16.0+incompatible
github.com/emicklei/go-restful-openapi v1.2.0
github.com/evanphx/json-patch v4.12.0+incompatible
github.com/fsnotify/fsnotify v1.5.1
github.com/fsnotify/fsnotify v1.5.4
github.com/ghodss/yaml v1.0.0
github.com/go-kit/kit v0.9.0
github.com/go-openapi/errors v0.19.9
Expand All @@ -28,7 +28,7 @@ require (
github.com/google/uuid v1.3.0
github.com/gordonklaus/ineffassign v0.0.0-20210209182638-d0e41b2fc8ed
github.com/gorilla/websocket v1.5.0
github.com/imdario/mergo v0.3.12
github.com/imdario/mergo v0.3.13
github.com/insomniacslk/dhcp v0.0.0-20201112113307-4de412bc85d8
github.com/k8snetworkplumbingwg/network-attachment-definition-client v1.3.0
github.com/kisielk/errcheck v1.6.2
Expand All @@ -37,12 +37,12 @@ require (
github.com/mdlayher/vsock v1.1.1
github.com/mitchellh/go-ps v0.0.0-20190716172923-621e5597135b
github.com/mitchellh/go-vnc v0.0.0-20150629162542-723ed9867aed
github.com/moby/sys/mountinfo v0.5.0
github.com/moby/sys/mountinfo v0.6.2
github.com/nunnatsa/ginkgolinter v0.4.1
github.com/onsi/ginkgo/v2 v2.1.3
github.com/onsi/gomega v1.19.0
github.com/opencontainers/runc v1.1.2
github.com/opencontainers/selinux v1.10.0
github.com/onsi/ginkgo/v2 v2.2.0
github.com/onsi/gomega v1.20.2
github.com/opencontainers/runc v1.1.4
github.com/opencontainers/selinux v1.10.2
github.com/openshift/api v0.0.0
github.com/openshift/client-go v0.0.0
github.com/openshift/library-go v0.0.0-20211220195323-eca2c467c492
Expand All @@ -56,15 +56,15 @@ require (
github.com/prometheus/common v0.28.0
github.com/spf13/cobra v1.5.0
github.com/spf13/pflag v1.0.5
github.com/vishvananda/netlink v1.1.1-0.20201029203352-d40f9887b852
github.com/vishvananda/netlink v1.1.1-0.20210330154013-f5de75959ad5
github.com/wadey/gocovmerge v0.0.0-20160331181800-b5bfa59ec0ad
golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e
golang.org/x/net v0.0.0-20220225172249-27dd8689420f
golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
golang.org/x/crypto v0.0.0-20220919173607-35f4265a4bc0
golang.org/x/net v0.0.0-20220909164309-bea034e7d591
golang.org/x/sys v0.0.0-20220919091848-fb04ddd9f9c8
golang.org/x/term v0.0.0-20220526004731-065cf7ba2467
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac
golang.org/x/tools v0.1.11
google.golang.org/grpc v1.40.0
google.golang.org/grpc v1.48.0
gopkg.in/cheggaaa/pb.v1 v1.0.28
gopkg.in/yaml.v2 v2.4.0
k8s.io/api v0.23.5
Expand All @@ -78,7 +78,7 @@ require (
k8s.io/utils v0.0.0-20211116205334-6203023598ed
kubevirt.io/api v0.0.0-00010101000000-000000000000
kubevirt.io/client-go v0.0.0-00010101000000-000000000000
kubevirt.io/containerized-data-importer v1.55.0
kubevirt.io/containerized-data-importer v1.40.0
kubevirt.io/containerized-data-importer-api v1.55.0
kubevirt.io/controller-lifecycle-operator-sdk/api v0.0.0-20220329064328-f3cc58c6ed90
kubevirt.io/qe-tools v0.1.8
Expand All @@ -97,12 +97,12 @@ require (
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
github.com/PuerkitoBio/purell v1.1.1 // indirect
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
github.com/VividCortex/ewma v1.1.1 // indirect
github.com/VividCortex/ewma v1.2.0 // indirect
github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/cespare/xxhash/v2 v2.1.2 // indirect
github.com/cilium/ebpf v0.7.0 // indirect
github.com/coreos/go-systemd/v22 v22.3.2 // indirect
github.com/coreos/go-systemd/v22 v22.4.0 // indirect
github.com/cyphar/filepath-securejoin v0.2.3 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/fatih/color v1.10.0 // indirect
Expand All @@ -117,9 +117,9 @@ require (
github.com/go-openapi/swag v0.21.1 // indirect
github.com/go-stack/stack v1.8.0 // indirect
github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
github.com/godbus/dbus/v5 v5.0.6 // indirect
github.com/godbus/dbus/v5 v5.1.0 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/google/go-cmp v0.5.7 // indirect
github.com/google/go-cmp v0.5.9 // indirect
github.com/google/go-querystring v1.0.0 // indirect
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect
github.com/google/renameio v0.1.0 // indirect
Expand All @@ -130,7 +130,7 @@ require (
github.com/mailru/easyjson v0.7.7 // indirect
github.com/mattn/go-colorable v0.1.8 // indirect
github.com/mattn/go-isatty v0.0.12 // indirect
github.com/mattn/go-runewidth v0.0.12 // indirect
github.com/mattn/go-runewidth v0.0.13 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
github.com/mdlayher/socket v0.2.0 // indirect
github.com/mitchellh/mapstructure v1.4.1 // indirect
Expand All @@ -142,27 +142,30 @@ require (
github.com/pkg/diff v0.0.0-20190930165518-531926345625 // indirect
github.com/prometheus/procfs v0.6.0 // indirect
github.com/rivo/uniseg v0.2.0 // indirect
github.com/sirupsen/logrus v1.8.1 // indirect
github.com/seccomp/libseccomp-golang v0.10.0 // indirect
github.com/sirupsen/logrus v1.9.0 // indirect
github.com/u-root/u-root v7.0.0+incompatible // indirect
github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae // indirect
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f // indirect
github.com/willf/bitset v1.1.11 // indirect
go.mongodb.org/mongo-driver v1.8.4 // indirect
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 // indirect
golang.org/x/text v0.3.7 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2 // indirect
google.golang.org/protobuf v1.27.1 // indirect
google.golang.org/genproto v0.0.0-20220720214146-176da50484ac // indirect
google.golang.org/protobuf v1.28.1 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v3 v3.0.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
kubevirt.io/controller-lifecycle-operator-sdk v0.2.1-0.20210723143736-64585ea1d1bd // indirect
mvdan.cc/editorconfig v0.1.1-0.20200121172147-e40951bde157 // indirect
sigs.k8s.io/controller-runtime v0.11.1 // indirect
sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
)

require (
github.com/containers/common v0.50.1
github.com/google/goterm v0.0.0-20190311235235-ce302be1d114 // indirect; indirect github.com/gophercloud/gophercloud v0.4.0 // indirect
github.com/operator-framework/go-appr v0.0.0-20180917210448-f2aef88446f2 // indirect
)
Expand Down
Loading

0 comments on commit 9f1bdd7

Please sign in to comment.