Skip to content

Commit

Permalink
feature: support get security options in daemon
Browse files Browse the repository at this point in the history
show daemon security options, include four part,
seccomp, apparmor, selinux and userns.

Signed-off-by: Ace-Tang <[email protected]>
  • Loading branch information
Ace-Tang authored and fuweid committed Nov 2, 2018
1 parent 87544ad commit bbba129
Show file tree
Hide file tree
Showing 3 changed files with 27 additions and 2 deletions.
5 changes: 5 additions & 0 deletions daemon/mgr/spec_seccomp_linux.go
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,11 @@ import (
specs "github.com/opencontainers/runtime-spec/specs-go"
)

// IsSeccompEnable return true since pouch support seccomp in build
func IsSeccompEnable() bool {
return true
}

// setupSeccomp creates seccomp security settings spec.
func setupSeccomp(ctx context.Context, c *Container, s *specs.Spec) error {
if c.HostConfig.Privileged {
Expand Down
5 changes: 5 additions & 0 deletions daemon/mgr/spec_seccomp_unsupported.go
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,11 @@ import (
specs "github.com/opencontainers/runtime-spec/specs-go"
)

// IsSeccompEnable return false since pouch do not support seccomp in build
func IsSeccompEnable() bool {
return false
}

func setupSeccomp(ctx context.Context, c *Container, s *specs.Spec) error {
if c.SeccompProfile != "" && c.SeccompProfile != "unconfined" {
return fmt.Errorf("Seccomp is not support by pouch, can not set seccomp profile %s", c.SeccompProfile)
Expand Down
19 changes: 17 additions & 2 deletions daemon/mgr/system.go
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ import (
"github.com/alibaba/pouch/registry"
volumedriver "github.com/alibaba/pouch/storage/volume/driver"
"github.com/alibaba/pouch/version"
"github.com/opencontainers/runc/libcontainer/apparmor"
selinux "github.com/opencontainers/selinux/go-selinux"

"github.com/pkg/errors"
"github.com/sirupsen/logrus"
Expand Down Expand Up @@ -112,6 +114,19 @@ func (mgr *SystemManager) Info() (types.SystemInfo, error) {
}
volumeDrivers := volumedriver.AllDriversName()

// security options get four part, seccomp, apparmor, selinux and userns
securityOpts := []string{}
sysInfo := system.NewInfo()
if sysInfo.Seccomp && IsSeccompEnable() {
securityOpts = append(securityOpts, "seccomp")
}
if sysInfo.AppArmor && apparmor.IsEnabled() {
securityOpts = append(securityOpts, "apparmor")
}
if selinux.GetEnabled() {
securityOpts = append(securityOpts, "selinux")
}

info := types.SystemInfo{
Architecture: runtime.GOARCH,
// CgroupDriver: ,
Expand Down Expand Up @@ -148,8 +163,8 @@ func (mgr *SystemManager) Info() (types.SystemInfo, error) {
PouchRootDir: mgr.config.HomeDir,
RegistryConfig: &mgr.config.RegistryService,
// RuncCommit: ,
Runtimes: mgr.config.Runtimes,
// SecurityOptions: ,
Runtimes: mgr.config.Runtimes,
SecurityOptions: securityOpts,
ServerVersion: version.Version,
ListenAddresses: mgr.config.Listen,
}
Expand Down

0 comments on commit bbba129

Please sign in to comment.