From 4a4d4f109b6b257a7189e946d9f1858a3ac8e010 Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Wed, 28 Jul 2021 08:55:32 +0200 Subject: [PATCH] Add support for seccomp actions ActKillThread and ActKillProcess Two new seccomp actions have been added to the libseccomp-golang dependency, which can be now supported by runc, too. ActKillThread kills the thread that violated the rule. It is the same as ActKill. All other threads from the same thread group will continue to execute. ActKillProcess kills the process that violated the rule. All threads in the thread group are also terminated. This action is only usable when libseccomp API level 3 or higher is supported. Signed-off-by: Sascha Grunert Signed-off-by: Aleksa Sarai --- libcontainer/configs/config.go | 2 ++ libcontainer/seccomp/seccomp_linux.go | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/libcontainer/configs/config.go b/libcontainer/configs/config.go index e0db8e01782..329f05ccb79 100644 --- a/libcontainer/configs/config.go +++ b/libcontainer/configs/config.go @@ -50,6 +50,8 @@ const ( Trace Log Notify + KillThread + KillProcess ) // Operator is a comparison operator to be used when matching syscall arguments in Seccomp diff --git a/libcontainer/seccomp/seccomp_linux.go b/libcontainer/seccomp/seccomp_linux.go index 2ec35464cca..f552aba486d 100644 --- a/libcontainer/seccomp/seccomp_linux.go +++ b/libcontainer/seccomp/seccomp_linux.go @@ -133,6 +133,10 @@ func getAction(act configs.Action, errnoRet *uint) (libseccomp.ScmpAction, error return libseccomp.ActLog, nil case configs.Notify: return libseccomp.ActNotify, nil + case configs.KillThread: + return libseccomp.ActKillThread, nil + case configs.KillProcess: + return libseccomp.ActKillProcess, nil default: return libseccomp.ActInvalid, errors.New("invalid action, cannot use in rule") }