Commits on Apr 25, 2017

1. config-linux: Make linux.seccomp.syscalls OPTIONAL …

   Before this commit, linux.seccomp.sycalls was required, but we didn't
   require an entry in the array.  That means '"syscalls": []' would be
   technically valid, and I'm pretty sure that's not what we want.
   
   If it makes sense to have a seccomp property that does not need
   syscalls entries, then syscalls should be optional (which is what this
   commit is doing).
   
   If it does not makes sense to have an empty/unset syscalls then it
   should be required and have a minimum length of one.
   
   Before 652323c (improve seccomp format to be more expressive,
   2017-01-13, opencontainers#657), syscalls was omitempty (and therefore more
   optional-feeling, although there was no real Markdown spec for seccomp
   before 3ca5c6c, config-linux.md: fix seccomp, 2017-03-02, opencontainers#706, so
   it's hard to know).  This commit has gone with OPTIONAL, because a
   seccomp config which only sets defaultAction seems potentially valid.
   
   The SCMP_ACT_KILL example is prompted by:
   
   On Tue, Apr 25, 2017 at 01:32:26PM -0700, David Lyle wrote [1]:
   > Technically, OPTIONAL is the right value, but unless you specify the
   > default action for seccomp to be SCMP_ACT_ALLOW the result will be
   > an error at run time.
   >
   > I would suggest an additional clarification to this fact in
   > config-linux.md would be very helpful if marking syscall as
   > OPTIONAL.
   
   I've phrased the example more conservatively, because I'm not sure
   that SCMP_ACT_ALLOW is the only possible value to avoid an error.  For
   example, perhaps a SCMP_ACT_TRACE default with an empty syscalls array
   would not die on the first syscall.  The point of the example is to
   remind config authors that without a useful syscalls array, the
   default value is very important ;).
   
   Also add the previously-missing 'required' property to the seccomp
   JSON Schema entry.
   
   [1]: opencontainers#768 (comment)
   
   Signed-off-by: W. Trevor King <wking@tremily.us>

   

   wking committed Apr 25, 2017
   Configuration menu

   • View commit details
   • Copy full SHA for 42984e8
   • Browse repository at this point

   Copy the full SHA

   42984e8 View commit details

   Browse the repository at this point in the history