Browse Source

Fix seccomp output in `docker info`

This fix tries to address the issue raised in #24374 where
`docker info` outputs seccomp support in Ubuntu 14.04 but
the seccomp wass not actually supported.

The issue is that in the current docker implementation, seccomp
support is only checked against the kernel by inspect CONFIG_SECCOMP
and CONFIG_SECCOMP_FILTER. However, seccomp might not be enabled
when building docker (through golang build flag).

This fix adds a supportSeccomp boolean variable. The supportSeccomp
is only set to true when seccomp is enabled when building docker.

This fix fixes #24374.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Yong Tang 9 years ago
parent
commit
a3b9dd89a1
4 changed files with 11 additions and 2 deletions
  1. 1 1
      daemon/info.go
  2. 3 1
      daemon/seccomp_disabled.go
  3. 2 0
      daemon/seccomp_linux.go
  4. 5 0
      daemon/seccomp_unsupported.go

+ 1 - 1
daemon/info.go

@@ -71,7 +71,7 @@ func (daemon *Daemon) SystemInfo() (*types.Info, error) {
 	if sysInfo.AppArmor {
 	if sysInfo.AppArmor {
 		securityOptions = append(securityOptions, "apparmor")
 		securityOptions = append(securityOptions, "apparmor")
 	}
 	}
-	if sysInfo.Seccomp {
+	if sysInfo.Seccomp && supportsSeccomp {
 		securityOptions = append(securityOptions, "seccomp")
 		securityOptions = append(securityOptions, "seccomp")
 	}
 	}
 	if selinuxEnabled() {
 	if selinuxEnabled() {

+ 3 - 1
daemon/seccomp_disabled.go

@@ -1,4 +1,4 @@
-// +build !seccomp,!windows
+// +build linux,!seccomp
 
 
 package daemon
 package daemon
 
 
@@ -9,6 +9,8 @@ import (
 	"github.com/opencontainers/specs/specs-go"
 	"github.com/opencontainers/specs/specs-go"
 )
 )
 
 
+var supportsSeccomp = false
+
 func setSeccomp(daemon *Daemon, rs *specs.Spec, c *container.Container) error {
 func setSeccomp(daemon *Daemon, rs *specs.Spec, c *container.Container) error {
 	if c.SeccompProfile != "" && c.SeccompProfile != "unconfined" {
 	if c.SeccompProfile != "" && c.SeccompProfile != "unconfined" {
 		return fmt.Errorf("seccomp profiles are not supported on this daemon, you cannot specify a custom seccomp profile")
 		return fmt.Errorf("seccomp profiles are not supported on this daemon, you cannot specify a custom seccomp profile")

+ 2 - 0
daemon/seccomp_linux.go

@@ -11,6 +11,8 @@ import (
 	"github.com/opencontainers/specs/specs-go"
 	"github.com/opencontainers/specs/specs-go"
 )
 )
 
 
+var supportsSeccomp = true
+
 func setSeccomp(daemon *Daemon, rs *specs.Spec, c *container.Container) error {
 func setSeccomp(daemon *Daemon, rs *specs.Spec, c *container.Container) error {
 	var profile *specs.Seccomp
 	var profile *specs.Seccomp
 	var err error
 	var err error

+ 5 - 0
daemon/seccomp_unsupported.go

@@ -0,0 +1,5 @@
+// +build !linux
+
+package daemon
+
+var supportsSeccomp = false