opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-19 12:12:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Set default seccomp.json file for podman play kube

Browse Source 
Currently podman play kube is not using the system default seccomp.json file.
This PR will use the default or override location for podman play.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2019-10-29 13:33:44 -04:00
committed by Nalin Dahyabhai
parent 248bb61b14
commit 66c126d6de
3 changed files with 26 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
cmd/podman/shared/create.go
View File

@ -251,19 +251,10 @@ func parseSecurityOpt(config *cc.CreateConfig, securityOpts []string, runtime *l
} }
if config.SeccompProfilePath == "" { if config.SeccompProfilePath == "" {
if _, err := os.Stat(libpod.SeccompOverridePath); err == nil { var err error
config.SeccompProfilePath = libpod.SeccompOverridePath config.SeccompProfilePath, err = libpod.DefaultSeccompPath()
} else { if err != nil {
if !os.IsNotExist(err) { return err
return errors.Wrapf(err, "can't check if %q exists", libpod.SeccompOverridePath)
}
if _, err := os.Stat(libpod.SeccompDefaultPath); err != nil {
if !os.IsNotExist(err) {
return errors.Wrapf(err, "can't check if %q exists", libpod.SeccompDefaultPath)
}
} else {
config.SeccompProfilePath = libpod.SeccompDefaultPath
}
} }
} }
config.LabelOpts = labelOpts config.LabelOpts = labelOpts

17
libpod/util.go
View File

@ -189,3 +189,20 @@ func programVersion(mountProgram string) (string, error) {
} }
return strings.TrimSuffix(output, "\n"), nil return strings.TrimSuffix(output, "\n"), nil
} }
func DefaultSeccompPath() (string, error) {
_, err := os.Stat(SeccompOverridePath)
if err == nil {
return SeccompOverridePath, nil
}
if !os.IsNotExist(err) {
return "", errors.Wrapf(err, "can't check if %q exists", SeccompOverridePath)
}
if _, err := os.Stat(SeccompDefaultPath); err != nil {
if !os.IsNotExist(err) {
return "", errors.Wrapf(err, "can't check if %q exists", SeccompDefaultPath)
}
return "", nil
}
return SeccompDefaultPath, nil
}

5
pkg/adapter/pods.go
View File

@ -713,6 +713,11 @@ func kubeContainerToCreateConfig(ctx context.Context, containerYAML v1.Container
} }
} }
} }
var err error
containerConfig.SeccompProfilePath, err = libpod.DefaultSeccompPath()
if err != nil {
return nil, err
}
containerConfig.Command = []string{} containerConfig.Command = []string{}
if imageData != nil && imageData.Config != nil { if imageData != nil && imageData.Config != nil {