From e9cf09ef6800b7740b2c9a7fe7efcf6af91fbc9f Mon Sep 17 00:00:00 2001 From: zhongjiawei Date: Thu, 5 Jan 2023 16:34:57 +0800 Subject: [PATCH] runc: support set seccomp priority --- libcontainer/configs/config.go | 1 + libcontainer/seccomp/seccomp_linux.go | 2 +- libcontainer/specconv/spec_linux.go | 1 + .../github.com/opencontainers/runtime-spec/specs-go/config.go | 1 + 4 files changed, 4 insertions(+), 1 deletion(-) diff --git a/libcontainer/configs/config.go b/libcontainer/configs/config.go index cda79bf..f85ade3 100644 --- a/libcontainer/configs/config.go +++ b/libcontainer/configs/config.go @@ -88,6 +88,7 @@ type Syscall struct { Name string `json:"name"` Action Action `json:"action"` ErrnoRet *uint `json:"errnoRet"` + Priority uint8 `json:"priority,omitempty"` Args []*Arg `json:"args"` } diff --git a/libcontainer/seccomp/seccomp_linux.go b/libcontainer/seccomp/seccomp_linux.go index 8c12af7..e4b5750 100644 --- a/libcontainer/seccomp/seccomp_linux.go +++ b/libcontainer/seccomp/seccomp_linux.go @@ -256,7 +256,7 @@ func matchCall(filter *libseccomp.ScmpFilter, call *configs.Syscall, defAct libs } } - return nil + return filter.SetSyscallPriority(callNum, call.Priority) } // Version returns major, minor, and micro. diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go index 19dd947..02a7439 100644 --- a/libcontainer/specconv/spec_linux.go +++ b/libcontainer/specconv/spec_linux.go @@ -1061,6 +1061,7 @@ func SetupSeccomp(config *specs.LinuxSeccomp) (*configs.Seccomp, error) { Name: name, Action: newAction, ErrnoRet: call.ErrnoRet, + Priority: call.Priority, Args: []*configs.Arg{}, } // Loop through all the arguments of the syscall and convert them diff --git a/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go b/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go index e8143b2..135f74a 100644 --- a/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go +++ b/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go @@ -688,6 +688,7 @@ type LinuxSyscall struct { Names []string `json:"names"` Action LinuxSeccompAction `json:"action"` ErrnoRet *uint `json:"errnoRet,omitempty"` + Priority uint8 `json:"priority,omitempty"` Args []LinuxSeccompArg `json:"args,omitempty"` } -- 2.30.0