Add const for "unconfined" and default seccomp profiles

thaJeztah · thaJeztah · commit ee02257553d8 · 2021-08-07T15:36:06.000+02:00
Signed-off-by: Sebastiaan van Stijn &lt;github@gone.nl&gt;
diff --git a/daemon/config/config.go b/daemon/config/config.go
@@ -58,6 +58,12 @@ const (
 	LinuxV1RuntimeName = "io.containerd.runtime.v1.linux"
 	// LinuxV2RuntimeName is the runtime used to specify the containerd v2 runc shim
 	LinuxV2RuntimeName = "io.containerd.runc.v2"
+
+	// SeccompProfileDefault is the built-in default seccomp profile.
+	SeccompProfileDefault = "default"
+	// SeccompProfileUnconfined is a special profile name for seccomp to use an
+	// "unconfined" seccomp profile.
+	SeccompProfileUnconfined = "unconfined"
 )
 
 var builtinRuntimes = map[string]bool{
diff --git a/daemon/info.go b/daemon/info.go
@@ -174,7 +174,7 @@ func (daemon *Daemon) fillSecurityOptions(v *types.Info, sysInfo *sysinfo.SysInf
 	if sysInfo.Seccomp && supportsSeccomp {
 		profile := daemon.seccompProfilePath
 		if profile == "" {
-			profile = "default"
+			profile = config.SeccompProfileDefault
 		}
 		securityOptions = append(securityOptions, fmt.Sprintf("name=seccomp,profile=%s", profile))
 	}
diff --git a/daemon/seccomp_disabled.go b/daemon/seccomp_disabled.go
@@ -9,14 +9,15 @@ import (
 	"github.com/containerd/containerd/containers"
 	coci "github.com/containerd/containerd/oci"
 	"github.com/docker/docker/container"
+	dconfig "github.com/docker/docker/daemon/config"
 )
 
 const supportsSeccomp = false
 
 // WithSeccomp sets the seccomp profile
 func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {
 	return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
-		if c.SeccompProfile != "" && c.SeccompProfile != "unconfined" {
+		if c.SeccompProfile != "" && c.SeccompProfile != dconfig.SeccompProfileUnconfined {
 			return fmt.Errorf("seccomp profiles are not supported on this daemon, you cannot specify a custom seccomp profile")
 		}
 		return nil
diff --git a/daemon/seccomp_linux.go b/daemon/seccomp_linux.go
@@ -9,6 +9,7 @@ import (
 	"github.com/containerd/containerd/containers"
 	coci "github.com/containerd/containerd/oci"
 	"github.com/docker/docker/container"
+	dconfig "github.com/docker/docker/daemon/config"
 	"github.com/docker/docker/profiles/seccomp"
 	"github.com/sirupsen/logrus"
 )
@@ -18,7 +19,7 @@ const supportsSeccomp = true
 // WithSeccomp sets the seccomp profile
 func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {
 	return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
-		if c.SeccompProfile == "unconfined" {
+		if c.SeccompProfile == dconfig.SeccompProfileUnconfined {
 			return nil
 		}
 		if c.HostConfig.Privileged {
@@ -29,7 +30,7 @@ func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {
 				return fmt.Errorf("seccomp is not enabled in your kernel, cannot run a custom seccomp profile")
 			}
 			logrus.Warn("seccomp is not enabled in your kernel, running container without default profile")
-			c.SeccompProfile = "unconfined"
+			c.SeccompProfile = dconfig.SeccompProfileUnconfined
 			return nil
 		}
 		var err error
diff --git a/daemon/seccomp_linux_test.go b/daemon/seccomp_linux_test.go
@@ -8,6 +8,7 @@ import (
 	coci "github.com/containerd/containerd/oci"
 	config "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/container"
+	dconfig "github.com/docker/docker/daemon/config"
 	doci "github.com/docker/docker/oci"
 	"github.com/docker/docker/profiles/seccomp"
 	specs "github.com/opencontainers/runtime-spec/specs-go"
@@ -32,7 +33,7 @@ func TestWithSeccomp(t *testing.T) {
 				seccompEnabled: true,
 			},
 			c: &container.Container{
-				SeccompProfile: "unconfined",
+				SeccompProfile: dconfig.SeccompProfileUnconfined,
 				HostConfig: &config.HostConfig{
 					Privileged: false,
 				},
diff --git a/integration-cli/docker_cli_info_unix_test.go b/integration-cli/docker_cli_info_unix_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/docker/docker/client"
+	"github.com/docker/docker/daemon/config"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
 )
@@ -27,6 +28,6 @@ func (s *DockerSuite) TestInfoSecurityOptions(c *testing.T) {
 		assert.Check(c, is.Contains(info.SecurityOptions, "name=apparmor"))
 	}
 	if seccompEnabled() {
-		assert.Check(c, is.Contains(info.SecurityOptions, "name=seccomp,profile=default"))
+		assert.Check(c, is.Contains(info.SecurityOptions, "name=seccomp,profile="+config.SeccompProfileDefault))
 	}
 }

Original file line number	Diff line number	Diff line change
`@@ -174,7 +174,7 @@ func (daemon Daemon) fillSecurityOptions(v types.Info, sysInfo *sysinfo.SysInf`
`174`	`174`	`if sysInfo.Seccomp && supportsSeccomp {`
`175`	`175`	`profile := daemon.seccompProfilePath`
`176`	`176`	`if profile == "" {`
`177`		`- profile = "default"`
	`177`	`+ profile = config.SeccompProfileDefault`
`178`	`178`	`}`
`179`	`179`	`securityOptions = append(securityOptions, fmt.Sprintf("name=seccomp,profile=%s", profile))`
`180`	`180`	`}`
Original file line number	Diff line number	Diff line change
`@@ -9,6 +9,7 @@ import (`
`9`	`9`	`"github.com/containerd/containerd/containers"`
`10`	`10`	`coci "github.com/containerd/containerd/oci"`
`11`	`11`	`"github.com/docker/docker/container"`
	`12`	`+ dconfig "github.com/docker/docker/daemon/config"`
`12`	`13`	`"github.com/docker/docker/profiles/seccomp"`
`13`	`14`	`"github.com/sirupsen/logrus"`
`14`	`15`	`)`
`@@ -18,7 +19,7 @@ const supportsSeccomp = true`
`18`	`19`	`// WithSeccomp sets the seccomp profile`
`19`	`20`	`func WithSeccomp(daemon Daemon, c container.Container) coci.SpecOpts {`
`20`	`21`	`return func(ctx context.Context, _ coci.Client, _ containers.Container, s coci.Spec) error {`
`21`		`- if c.SeccompProfile == "unconfined" {`
	`22`	`+ if c.SeccompProfile == dconfig.SeccompProfileUnconfined {`
`22`	`23`	`return nil`
`23`	`24`	`}`
`24`	`25`	`if c.HostConfig.Privileged {`
`@@ -29,7 +30,7 @@ func WithSeccomp(daemon Daemon, c container.Container) coci.SpecOpts {`
`29`	`30`	`return fmt.Errorf("seccomp is not enabled in your kernel, cannot run a custom seccomp profile")`
`30`	`31`	`}`
`31`	`32`	`logrus.Warn("seccomp is not enabled in your kernel, running container without default profile")`
`32`		`- c.SeccompProfile = "unconfined"`
	`33`	`+ c.SeccompProfile = dconfig.SeccompProfileUnconfined`
`33`	`34`	`return nil`
`34`	`35`	`}`
`35`	`36`	`var err error`
Original file line number	Diff line number	Diff line change
`@@ -7,6 +7,7 @@ import (`
`7`	`7`	`"testing"`
`8`	`8`
`9`	`9`	`"github.com/docker/docker/client"`
	`10`	`+ "github.com/docker/docker/daemon/config"`
`10`	`11`	`"gotest.tools/v3/assert"`
`11`	`12`	`is "gotest.tools/v3/assert/cmp"`
`12`	`13`	`)`
`@@ -27,6 +28,6 @@ func (s DockerSuite) TestInfoSecurityOptions(c testing.T) {`
`27`	`28`	`assert.Check(c, is.Contains(info.SecurityOptions, "name=apparmor"))`
`28`	`29`	`}`
`29`	`30`	`if seccompEnabled() {`
`30`		`- assert.Check(c, is.Contains(info.SecurityOptions, "name=seccomp,profile=default"))`
	`31`	`+ assert.Check(c, is.Contains(info.SecurityOptions, "name=seccomp,profile="+config.SeccompProfileDefault))`
`31`	`32`	`}`
`32`	`33`	`}`