beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Remove "seccomp" build tag

Browse source 
Similar to the (now removed) `apparmor` build tag, this build-time toggle existed for users who needed to build without the `libseccomp` library.  That's no longer necessary, and given the importance of seccomp to the overall default security profile of Docker containers, it makes sense that any binary built for Linux should support (and use by default) seccomp if the underlying host does.

Signed-off-by: Tianon Gravi <admwiggin@gmail.com>
This commit is contained in:
Tianon Gravi 2021-06-09 11:52:10 -07:00
parent 888c618c15
commit c9e19a2aa1
11 changed files with 5 additions and 74 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Dockerfile
View file

@ -5,7 +5,6 @@ ARG SYSTEMD="false"
ARG GO_VERSION=1.18.2
ARG DEBIAN_FRONTEND=noninteractive
ARG VPNKIT_VERSION=0.5.0
ARG DOCKER_BUILDTAGS="apparmor seccomp"
ARG BASE_DEBIAN_DISTRO="bullseye"
ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"

26
daemon/seccomp_disabled.go
View file

@ -1,26 +0,0 @@
//go:build linux && !seccomp
// +build linux,!seccomp
package daemon // import "github.com/docker/docker/daemon"
import (
"context"
"fmt"
"github.com/containerd/containerd/containers"
coci "github.com/containerd/containerd/oci"
"github.com/docker/docker/container"
dconfig "github.com/docker/docker/daemon/config"
)
const supportsSeccomp = false
// WithSeccomp sets the seccomp profile
func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {
return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
if c.SeccompProfile != "" && c.SeccompProfile != dconfig.SeccompProfileUnconfined {
return fmt.Errorf("seccomp profiles are not supported on this daemon, you cannot specify a custom seccomp profile")
}
return nil
}
}

3
daemon/seccomp_linux.go
View file

@ -1,6 +1,3 @@
//go:build linux && seccomp
// +build linux,seccomp
package daemon // import "github.com/docker/docker/daemon"
import (

3
daemon/seccomp_linux_test.go
View file

@ -1,6 +1,3 @@
//go:build linux && seccomp
// +build linux,seccomp
package daemon // import "github.com/docker/docker/daemon"
import (

2
hack/test/unit
View file

@ -12,7 +12,7 @@
#
set -eux -o pipefail
BUILDFLAGS=(-tags 'netgo seccomp libdm_no_deferred_remove')
BUILDFLAGS=(-tags 'netgo libdm_no_deferred_remove')
TESTFLAGS+=" -test.timeout=${TIMEOUT:-5m}"
TESTDIRS="${TESTDIRS:-./...}"
exclude_paths='/vendor/|/integration'

2
integration-cli/requirements_unix_test.go
View file

@ -62,7 +62,7 @@ func cgroupCpuset() bool {
}
func seccompEnabled() bool {
return supportsSeccomp && SysInfo.Seccomp
return SysInfo.Seccomp
}
func bridgeNfIptables() bool {

9
integration-cli/test_vars_noseccomp_test.go
View file

@ -1,9 +0,0 @@
//go:build !seccomp
// +build !seccomp
package main
const (
// indicates docker daemon built with seccomp support
supportsSeccomp = false
)

9
integration-cli/test_vars_seccomp_test.go
View file

@ -1,9 +0,0 @@
//go:build seccomp
// +build seccomp
package main
const (
// indicates docker daemon built with seccomp support
supportsSeccomp = true
)

3
profiles/seccomp/default_linux.go
View file

@ -1,6 +1,3 @@
//go:build seccomp
// +build seccomp
package seccomp // import "github.com/docker/docker/profiles/seccomp"
import (

9
profiles/seccomp/seccomp_unsupported.go
View file

@ -1,9 +0,0 @@
//go:build linux && !seccomp
// +build linux,!seccomp
package seccomp // import "github.com/docker/docker/profiles/seccomp"
// DefaultProfile returns a nil pointer on unsupported systems.
func DefaultProfile() *Seccomp {
return nil
}

12
project/PACKAGERS.md
View file

@ -81,14 +81,8 @@ Please use our build script ("./hack/make.sh") for compilation.
### `DOCKER_BUILDTAGS`
If you're building a binary that might be used on platforms that include
seccomp, you will need to use the `seccomp` build tag:
```bash
export DOCKER_BUILDTAGS='seccomp'
```
There are build tags for disabling graphdrivers as well. By default, support
for all graphdrivers are built in.
There are build tags for disabling graphdrivers, if necessary. By default,
support for all graphdrivers are built in.
To disable btrfs:
```bash
@ -107,7 +101,7 @@ export DOCKER_BUILDTAGS='exclude_graphdriver_aufs'
NOTE: if you need to set more than one build tag, space separate them:
```bash
export DOCKER_BUILDTAGS='apparmor exclude_graphdriver_aufs'
export DOCKER_BUILDTAGS='exclude_graphdriver_aufs exclude_graphdriver_btrfs'
```
## System Dependencies