mobi/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2025-12-04 19:23:06 +03:00
Code Activity

daemon: add a flag to override the default seccomp profile

Browse Source 
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
This commit is contained in:
Antonio Murdaca
2016-09-02 15:20:54 +02:00
parent ecd806cdf1
commit b237189e6c
15 changed files with 150 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
integration-cli/docker_cli_run_unix_test.go
View File

@@ -1375,3 +1375,37 @@ func (s *DockerDaemonSuite) TestRunSeccompJSONNoArchAndArchMap(c *check.C) {
c.Assert(err, check.NotNil)
c.Assert(out, checker.Contains, "'architectures' and 'archMap' were specified in the seccomp profile, use either 'architectures' or 'archMap'")
}
func (s *DockerDaemonSuite) TestRunWithDaemonDefaultSeccompProfile(c *check.C) {
testRequires(c, SameHostDaemon, seccompEnabled)
err := s.d.StartWithBusybox()
c.Assert(err, check.IsNil)
// 1) verify I can run containers with the Docker default shipped profile which allows chmod
_, err = s.d.Cmd("run", "busybox", "chmod", "777", ".")
c.Assert(err, check.IsNil)
jsonData := `{
"defaultAction": "SCMP_ACT_ALLOW",
"syscalls": [
{
"name": "chmod",
"action": "SCMP_ACT_ERRNO"
}
]
}`
tmpFile, err := ioutil.TempFile("", "profile.json")
c.Assert(err, check.IsNil)
defer tmpFile.Close()
_, err = tmpFile.Write([]byte(jsonData))
c.Assert(err, check.IsNil)
// 2) restart the daemon and add a custom seccomp profile in which we deny chmod
err = s.d.Restart("--seccomp-profile=" + tmpFile.Name())
c.Assert(err, check.IsNil)
out, err := s.d.Cmd("run", "busybox", "chmod", "777", ".")
c.Assert(err, check.NotNil)
c.Assert(out, checker.Contains, "Operation not permitted")
}