[WIP] - Generate seccomp profile by tracing the syscalls made by the container

Dockerfile

@@ -1,9 +1,13 @@
 FROM golang:1.12
 
+RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 4052245BD4284CDD \
+    && echo "deb https://repo.iovisor.org/apt/bionic bionic main" | tee /etc/apt/sources.list.d/iovisor.list
+
 RUN apt-get update && apt-get install -y \
     apparmor \
     autoconf \
     automake \
+    bcc-tools \
     bison \
     build-essential \
     curl \
@@ -34,6 +38,7 @@ RUN apt-get update && apt-get install -y \
     libdevmapper-dev \
     libgpgme11-dev \
     liblzma-dev \
+    libtinfo5 \
     netcat \
     socat \
     lsof \

Makefile

@@ -18,7 +18,9 @@ BINDIR ?= ${PREFIX}/bin
 LIBEXECDIR ?= ${PREFIX}/libexec
 MANDIR ?= ${PREFIX}/share/man
 SHAREDIR_CONTAINERS ?= ${PREFIX}/share/containers
+HOOK_BIN_DIR ?= ${PREFIX}/libexec/oci/hooks.d/
 ETCDIR ?= /etc
+HOOK_DIR ?= ${ETCDIR}/containers/oci/hooks.d/
 TMPFILESDIR ?= ${PREFIX}/lib/tmpfiles.d
 SYSTEMDDIR ?= ${PREFIX}/lib/systemd/system
 USERSYSTEMDDIR ?= ${PREFIX}/lib/systemd/user
@@ -34,6 +36,7 @@ BUILDTAGS ?= \
 	seccomp \
 	varlink
 
+BUILDTAG_TRACE_HOOK ?= $(shell hack/generate_seccomp_tag.sh)
 GO_BUILD=$(GO) build
 # Go module support: set `-mod=vendor` to use the vendored sources
 ifeq ($(shell go help mod >/dev/null 2>&1 && echo true), true)
@@ -46,6 +49,12 @@ $(warning \
 	Install libsystemd for journald support)
 endif
 
+ifeq (,$(BUILDTAG_TRACE_HOOK))
+$(warning \
+	Podman is being compiled without the oci_trace_hook build tag.\
+	Install libbcc to use the oci-trace-hook)
+endif
+
 BUILDTAGS_CROSS ?= containers_image_openpgp containers_image_ostree_stub exclude_graphdriver_btrfs exclude_graphdriver_devicemapper exclude_graphdriver_overlay
 ifneq (,$(findstring varlink,$(BUILDTAGS)))
 	PODMAN_VARLINK_DEPENDENCIES = cmd/podman/varlink/iopodman.go
@@ -306,7 +315,7 @@ run-perftest: perftest ## Build and run perf tests
 vagrant-check:
 	BOX=$(BOX) sh ./vagrant.sh
 
-binaries: varlink_generate podman podman-remote  ## Build podman
+binaries: varlink_generate podman podman-remote oci-trace-hook ## Build podman
 
 install.catatonit:
 	./hack/install_catatonit.sh
@@ -394,7 +403,7 @@ changelog: ## Generate changelog
 	$(shell cat $(TMPFILE) >> changelog.txt)
 	$(shell rm $(TMPFILE))
 
-install: .gopathok install.bin install.remote install.man install.cni install.systemd  ## Install binaries to system locations
+install: .gopathok install.bin install.remote install.man install.cni install.systemd install.oci-trace-hook ## Install binaries to system locations
 
 install.remote: podman-remote
 	install ${SELINUXOPT} -d -m 755 $(DESTDIR)$(BINDIR)
@@ -498,6 +507,21 @@ endef
 		make all install; \
 	fi
 
+
+install.oci-trace-hook:
+	if [ ! -z "$(BUILDTAG_TRACE_HOOK)" ]; then \
+		install ${SELINUXOPT} -d -m 755 ${DESTDIR}$(HOOK_BIN_DIR); \
+		install ${SELINUXOPT} -d -m 755 ${DESTDIR}$(HOOK_DIR) ; \
+		install ${SELINUXOPT} -m 755 bin/oci-trace-hook ${DESTDIR}$(HOOK_BIN_DIR) ; \
+		install ${SELINUXOPT} -m 644 cmd/oci-trace-hook/oci-trace-hook-run.json ${DESTDIR}$(HOOK_DIR) ; \
+		install ${SELINUXOPT} -m 644 cmd/oci-trace-hook/oci-trace-hook-stop.json ${DESTDIR}$(HOOK_DIR) ; \
+	fi
+
+oci-trace-hook:
+	if [ ! -z "$(BUILDTAG_TRACE_HOOK)" ] ; then \
+		$(GO_BUILD) -tags $(BUILDTAG_TRACE_HOOK) -o bin/oci-trace-hook $(PROJECT)/cmd/oci-trace-hook; \
+	fi
+
 varlink_generate: .gopathok cmd/podman/varlink/iopodman.go ## Generate varlink
 varlink_api_generate: .gopathok API.md
 

cmd/oci-trace-hook/oci-trace-hook-run.json

@@ -0,0 +1,18 @@
+{
+    "version": "1.0.0",
+    "hook": {
+        "path": "/usr/local/libexec/oci/hooks.d/oci-trace-hook",
+        "args": [
+            "oci-trace-hook",
+            "-s"
+        ]
+    },
+    "when": {
+        "annotations": {
+            "io.containers.trace-syscall": ".*"
+        }
+    },
+    "stages": [
+        "prestart"
+    ]
+}

cmd/oci-trace-hook/oci-trace-hook-stop.json

@@ -0,0 +1,18 @@
+{
+	"version": "1.0.0",
+	"hook": {
+		"path": "/usr/local/libexec/oci/hooks.d/oci-trace-hook",
+		"args": [
+			"oci-trace-hook",
+			"-t"
+		]
+	},
+	"when": {
+		"annotations": {
+			"io.containers.trace-syscall": ".*"
+		}
+	},
+	"stages": [
+		"poststop"
+	]
+}