Add seccomp feature

Makefile

@@ -18,6 +18,8 @@ direct-test-short:
 	go test $(TEST_TAGS) -cover -test.short -v $(GO_PACKAGES)
 
 direct-build:
+	chmod 755 hack/seccomp.sh
+	hack/seccomp.sh
 	go build -v $(GO_PACKAGES)
 
 direct-install:

configs/config.go

@@ -13,6 +13,10 @@ type IDMap struct {
 	Size        int `json:"size"`
 }
 
+type SeccompConf struct {
+	SysCalls []string `json:"syscalls"`
+}
+
 // TODO Windows. Many of these fields should be factored out into those parts
 // which are common across platforms, and those which are platform specific.
 
@@ -104,4 +108,7 @@ type Config struct {
 	// SystemProperties is a map of properties and their values. It is the equivalent of using
 	// sysctl -w my.property.name value in Linux.
 	SystemProperties map[string]string `json:"system_properties"`
+
+	// SysCalls specify the system calls to keep when executing the process inside the container
+	Seccomps SeccompConf `json:"seccomp"`
 }

configs/namespaces_linux.go

@@ -5,12 +5,13 @@ package configs
 import "fmt"
 
 const (
-	NEWNET  NamespaceType = "NEWNET"
-	NEWPID  NamespaceType = "NEWPID"
-	NEWNS   NamespaceType = "NEWNS"
-	NEWUTS  NamespaceType = "NEWUTS"
-	NEWIPC  NamespaceType = "NEWIPC"
-	NEWUSER NamespaceType = "NEWUSER"
+	NEWNET     NamespaceType = "NEWNET"
+	NEWPID     NamespaceType = "NEWPID"
+	NEWNS      NamespaceType = "NEWNS"
+	NEWUTS     NamespaceType = "NEWUTS"
+	NEWIPC     NamespaceType = "NEWIPC"
+	NEWUSER    NamespaceType = "NEWUSER"
+	NEWSECCOMP NamespaceType = "NEWSECCOMP"
 )
 
 func NamespaceTypes() []NamespaceType {

configs/namespaces_syscall.go

@@ -4,17 +4,22 @@ package configs
 
 import "syscall"
 
+var (
+	CLONE_SECCOMP = 0x10000 //diffrent from other flag, hard code
+)
+
 func (n *Namespace) Syscall() int {
 	return namespaceInfo[n.Type]
 }
 
 var namespaceInfo = map[NamespaceType]int{
-	NEWNET:  syscall.CLONE_NEWNET,
-	NEWNS:   syscall.CLONE_NEWNS,
-	NEWUSER: syscall.CLONE_NEWUSER,
-	NEWIPC:  syscall.CLONE_NEWIPC,
-	NEWUTS:  syscall.CLONE_NEWUTS,
-	NEWPID:  syscall.CLONE_NEWPID,
+	NEWNET:     syscall.CLONE_NEWNET,
+	NEWNS:      syscall.CLONE_NEWNS,
+	NEWUSER:    syscall.CLONE_NEWUSER,
+	NEWIPC:     syscall.CLONE_NEWIPC,
+	NEWUTS:     syscall.CLONE_NEWUTS,
+	NEWPID:     syscall.CLONE_NEWPID,
+	NEWSECCOMP: CLONE_SECCOMP,
 }
 
 // CloneFlags parses the container's Namespaces options to set the correct

container_linux.go

@@ -169,6 +169,13 @@ func (c *linuxContainer) newInitProcess(p *Process, cmd *exec.Cmd, parentPipe, c
 			cmd.SysProcAttr.Credential = &syscall.Credential{}
 		}
 	}
+	if cloneFlags&uintptr(configs.CLONE_SECCOMP) != 0 {
+		//os don't surport for CLONE_SECCOMP, remote it
+		c.config.Namespaces.Remove(configs.NEWSECCOMP)
+		cloneFlags = c.config.Namespaces.CloneFlags()
+	} else {
+		c.config.Seccomps.SysCalls = []string{}
+	}
 	cmd.Env = append(cmd.Env, t)
 	cmd.SysProcAttr.Cloneflags = cloneFlags
 	return &initProcess{

hack/seccomp.pl

@@ -0,0 +1,58 @@
+#!/usr/bin/perl
+
+# ./seccomp.pl < syscall.sample > seccompsyscall.go
+
+use strict;
+use warnings;
+
+my $pid = open(my $in, "-|") // die "Couldn't fork1 ($!)\n";
+
+if($pid == 0) {
+    $pid = open(my $out, "|-") // die "Couldn't fork2 ($!)\n";
+    if($pid == 0) { 
+        exec "cpp" or die "Couldn't exec cpp ($!)\n";
+        exit 1;
+    }
+
+    print $out "#include <sys/syscall.h>\n";
+    while(<>) {
+        if(/^\w/) {
+		    my $name="$_";
+			chomp($name);
+
+            print $out $name;
+			print $out " = ";
+			print $out "__NR_$_";
+        }
+    }
+    close $out;
+    exit 0;
+}
+print "//";
+system("uname -m");
+print "package seccomp\r\n\r\n";
+print "var syscallMap = map[string] int {\n";
+while(<$in>) {
+    my $line=$_;
+
+	if($line =~ /^[\da-z_]/)
+	{
+		my @personal=split(/=/);
+		$personal[0] =~ s/[ ]//;
+		$personal[1] =~ s/[\r\n]//;
+		print "	\"";
+		print $personal[0];
+		print "\"";
+		print " : ";
+		if (($personal[1] !~ /[0-9]/) || length($personal[1]) > 4)
+		{
+			print "-1,\r\n";			
+		}else{
+			print $personal[1];
+			print ",\r\n";
+		}
+	}
+}
+
+print "}\r\n";
+

hack/seccomp.sh

@@ -0,0 +1,4 @@
+#/bin/bash
+
+chmod 755 hack/seccomp.pl
+hack/seccomp.pl < hack/syscall.sample > seccomp/seccompsyscall.go