From 43f7fad4a110744a59835affe6e25e7ed4493939 Mon Sep 17 00:00:00 2001 From: viju Date: Sat, 15 Aug 2026 00:10:19 +0530 Subject: [PATCH] fix: drop the go side seccomp filter for hvt Ref: #648 Signed-off-by: viju --- .github/workflows/ci.yml | 2 +- .github/workflows/ci_devel.yml | 2 +- .github/workflows/ci_nightly.yml | 2 +- .github/workflows/vm_test.yml | 2 +- deployment/urunc-deploy/Dockerfile | 4 +- docs/design/seccomp.md | 25 +++----- docs/installation.md | 8 +-- docs/variables/versions.yml | 2 +- go.mod | 1 - go.sum | 2 - pkg/unikontainers/hypervisors/hvt.go | 95 +--------------------------- pkg/unikontainers/types/types.go | 4 +- pkg/unikontainers/unikontainers.go | 4 +- tests/e2e/test_cases.go | 16 ----- 14 files changed, 24 insertions(+), 145 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 112f8836e..f4d5f787e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -119,7 +119,7 @@ jobs: with: ref: ${{ inputs.ref }} firecracker_version: 'v1.7.0' - solo5_version: 'v0.9.3' + solo5_version: 'v0.12.1' runc_version: '1.3.0' secrets: inherit diff --git a/.github/workflows/ci_devel.yml b/.github/workflows/ci_devel.yml index 5a77c3c6b..fa8cd3cae 100644 --- a/.github/workflows/ci_devel.yml +++ b/.github/workflows/ci_devel.yml @@ -55,7 +55,7 @@ on: default: '' type: string solo5_version: - description: 'Solo5 version for the e2e tests (e.g. v0.9.3)' + description: 'Solo5 version for the e2e tests (e.g. v0.12.1)' required: false default: '' type: string diff --git a/.github/workflows/ci_nightly.yml b/.github/workflows/ci_nightly.yml index f8edc6368..d304a2287 100644 --- a/.github/workflows/ci_nightly.yml +++ b/.github/workflows/ci_nightly.yml @@ -40,7 +40,7 @@ jobs: uses: ./.github/workflows/kind_test.yml with: firecracker_version: 'v1.7.0' - solo5_version: 'v0.9.3' + solo5_version: 'v0.12.1' runc_version: '1.3.0' urunc_deploy_test: diff --git a/.github/workflows/vm_test.yml b/.github/workflows/vm_test.yml index 65c3ef2c4..c1f7fd4b0 100644 --- a/.github/workflows/vm_test.yml +++ b/.github/workflows/vm_test.yml @@ -55,7 +55,7 @@ env: CRICTL_VERSION: ${{ inputs.crictl_version || 'v1.30.0' }} FIRECRACKER_VERSION: ${{ inputs.firecracker_version || 'v1.7.0' }} CLOUD_HYPERVISOR_VERSION: ${{ inputs.cloud_hypervisor_version || 'v50.0' }} - SOLO5_VERSION: ${{ inputs.solo5_version || 'v0.9.3' }} + SOLO5_VERSION: ${{ inputs.solo5_version || 'v0.12.1' }} HLUK_VERSION: ${{ inputs.hluk_version || 'v0.18.0' }} jobs: diff --git a/deployment/urunc-deploy/Dockerfile b/deployment/urunc-deploy/Dockerfile index b5830d654..a2420bbd0 100644 --- a/deployment/urunc-deploy/Dockerfile +++ b/deployment/urunc-deploy/Dockerfile @@ -26,8 +26,8 @@ RUN rm -f /var/lib/dpkg/info/libc-bin.* && \ WORKDIR /app # Clone Solo5 repository and force static linking -RUN git -c http.sslVerify=false clone --branch v0.9.3 https://github.com/Solo5/solo5.git . && \ - sed -i '66 a\HOSTLDFLAGS += -static-pie' tenders/GNUmakefile +RUN git -c http.sslVerify=false clone --branch v0.12.1 https://github.com/Solo5/solo5.git . && \ + echo 'HOSTLDFLAGS += -static-pie' >> tenders/GNUmakefile # Build Solo5 and verify artifacts RUN ./configure.sh && make || true && \ diff --git a/docs/design/seccomp.md b/docs/design/seccomp.md index 2fb6fcf19..c139162f6 100644 --- a/docs/design/seccomp.md +++ b/docs/design/seccomp.md @@ -31,8 +31,8 @@ supported VMM. In particular, in the case of: all possible seccomp filters in Qemu. - Cloud-Hypervisor, 'urunc' makes use of the `--seccomp true` command line option to enable Cloud-Hypervisor's seccomp filters. -- Solo5-hvt, 'urunc' applies the seccomp filters before executing - 'Solo5-hvt'. +- Solo5-hvt, 'urunc' does not have to do anything more, since solo5-hvt makes use + of seccomp by itself, as of Solo5 v0.11.0. - Solo5-spt, 'urunc' can not do anything since solo5-spt makes use of seccomp by itself. @@ -42,21 +42,12 @@ Since 'urunc', in most cases, makes use of the VMM's mechanisms to enforce the seccomp filters, 'urunc' heavily relies on the VMM to properly restrict the system calls the VMM can use. -In the case of 'Solo5-hvt', since 'urunc' is responsible for applying the seccomp -filters, proper identification of the required system calls is necessary. -Unfortunately, due to dynamic linking and Go's runtime, it is +Up to Solo5 v0.10.x, 'urunc' was the one applying the seccomp filters for +'Solo5-hvt' and therefore proper identification of the required system calls was +necessary. Unfortunately, due to dynamic linking and Go's runtime, it is impossible to always predict correctly for every system the necessary system -calls for 'Solo5-hvt' execution. - -Nevertheless, 'Solo5-hvt' with seccomp in 'urunc' has been tested in Ubuntu 20.04 -and Ubuntu 22.04. Using 'urunc' and solo5-hvt on different platforms might result -in failed execution. For that reason, we strongly recommend running the seccomp -test first, by `make test_nerdctl_Seccomp`. In case the test fails, the seccomp -profile for 'Solo5-hvt' needs to get updated. - -For that reason, we created a toolset to identify the required system calls. -The toolset, along with instructions on how to use it, can be found in [goscall -repository](https://github.com/nubificus/goscall). +calls for 'Solo5-hvt' execution. Since Solo5 v0.11.0, 'Solo5-hvt' makes use of +seccomp by itself and hence 'urunc' does not have to do anything more. ## Setting a seccomp profile @@ -64,4 +55,4 @@ Due to its design, 'urunc' does not allow the definition of a seccomp profile ot than the default. However, users can totally disable seccomp by using the `--security-opt seccomp=unconfined` command line option. In that scenario, 'urunc' will not make use of any seccomp filters in all the supported VMMs, except -for 'Solo5-spt'. +for 'Solo5-hvt' and 'Solo5-spt', which make use of seccomp by themselves. diff --git a/docs/installation.md b/docs/installation.md index 05b8f94dc..72beeb877 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -348,20 +348,20 @@ file](https://github.com/urunc-dev/monitors-build?tab=readme-ov-file#how-to-use) > NOTE: Hyperlight-unikraft is not included in this bundle yet. As an example, the following commands use the -[`FC-v1.7.0_CLH-v50.0_S5-v0.9.3_VFS_-v1.13.0_QM-v10.1.1-9a44e` -release](https://github.com/urunc-dev/monitors-build/releases/tag/FC-v1.7.0_CLH-v50.0_S5-v0.9.3_VFS_-v1.13.0_QM-v10.1.1-9a44e) +[`FC-v1.7.0_CLH-v50.0_S5-v0.12.1_VFS_-v1.13.0_QM-v10.1.1-9a44e` +release](https://github.com/urunc-dev/monitors-build/releases/tag/FC-v1.7.0_CLH-v50.0_S5-v0.12.1_VFS_-v1.13.0_QM-v10.1.1-9a44e) which contains the following monitors and tools in the specified versions: - Firecracker v1.7.0 - Cloud Hypervisor v50.0 -- Solo5 v0.9.3 +- Solo5 v0.12.1 - Virtiofsd v1.13.0 - Qemu v10.1.1 To download and install the monitors in `/tmp`: ``` ARCH="$(dpkg --print-architecture)" -VERSION="FC-v1.7.0_CLH-v50.0_S5-v0.9.3_VFS_-v1.13.0_QM-v10.1.1-9a44e" +VERSION="FC-v1.7.0_CLH-v50.0_S5-v0.12.1_VFS_-v1.13.0_QM-v10.1.1-9a44e" release_url="https://github.com/urunc-dev/monitors-build/releases/download" wget ${release_url}/${VERSION}/release-${ARCH}-${VERSION}.tar.gz sudo tar Cxzvf /opt release-${ARCH}-${VERSION}.tar.gz diff --git a/docs/variables/versions.yml b/docs/variables/versions.yml index 604e0fd58..af2f14a6e 100644 --- a/docs/variables/versions.yml +++ b/docs/variables/versions.yml @@ -6,7 +6,7 @@ versions: qemu: "8.2.2" firecracker: "1.7.0" clh: "50.0" - solo5: "0.9.0" + solo5: "0.12.1" hyperlight-unikraft: "0.18.0" cni_plugins: "1.7.1" knative: "1.17.0" diff --git a/go.mod b/go.mod index 2935fd1b9..d20317daa 100644 --- a/go.mod +++ b/go.mod @@ -16,7 +16,6 @@ require ( github.com/containerd/ttrpc v1.2.10 github.com/creack/pty v1.1.24 github.com/cyphar/filepath-securejoin v0.7.0 - github.com/elastic/go-seccomp-bpf v1.6.0 github.com/hashicorp/go-version v1.9.0 github.com/jackpal/gateway v1.2.0 github.com/moby/sys/mountinfo v0.7.2 diff --git a/go.sum b/go.sum index b0b87eb4d..49276f50a 100644 --- a/go.sum +++ b/go.sum @@ -56,8 +56,6 @@ github.com/cyphar/filepath-securejoin v0.7.0 h1:s0Y3ITPy6sQn5xt54DuYvTF8hu134ooY github.com/cyphar/filepath-securejoin v0.7.0/go.mod h1:ymLGms/u3BYaviIiuKFnUx8EkQEZeK6cInNoAPJA3o4= github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= -github.com/elastic/go-seccomp-bpf v1.6.0 h1:NYduiYxRJ0ZkIyQVwlSskcqPPSg6ynu5pK0/d7SQATs= -github.com/elastic/go-seccomp-bpf v1.6.0/go.mod h1:5tFsTvH4NtWGfpjsOQD53H8HdVQ+zSZFRUDSGevC0Kc= github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs= github.com/gkampitakis/ciinfo v0.3.2/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo= github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M= diff --git a/pkg/unikontainers/hypervisors/hvt.go b/pkg/unikontainers/hypervisors/hvt.go index 3bbba247f..3e1932b56 100644 --- a/pkg/unikontainers/hypervisors/hvt.go +++ b/pkg/unikontainers/hypervisors/hvt.go @@ -16,9 +16,7 @@ package hypervisors import ( "os/exec" - "runtime" - seccomp "github.com/elastic/go-seccomp-bpf" "github.com/urunc-dev/urunc/pkg/unikontainers/types" "golang.org/x/sys/unix" ) @@ -35,92 +33,6 @@ type HVT struct { binary string } -// applySeccompFilter applies some seccomp filters for the Hvt process. -// By default all system calls will cause a SIGSYS, except the ones that we whitelist -func applySeccompFilter() error { - syscalls := []string{ - "rt_sigaction", - "ioctl", - "pread64", - "mmap", - "recvmsg", - "openat", - "sendto", - "mprotect", - "write", - "epoll_ctl", - "epoll_create1", - "read", - "close", - "fstat", - "munmap", - "brk", - "execve", - "timerfd_create", - "lseek", - "personality", - "socket", - "bind", - "getsockname", - "exit", - "exit_group", - "getpid", - "tgkill", - "nanosleep", - "futex", - "epoll_pwait", - "rt_sigreturn", - "timerfd_settime", - "pwrite64", - "set_tid_address", - "set_robust_list", - "rseq", - "prlimit64", - "getrandom", - } - - if runtime.GOARCH == "arm64" { - syscalls = append(syscalls, "faccessat", "fstatat") - } else { - syscalls = append(syscalls, "open", "stat", "access", "arch_prctl", "newfstatat") - } - // Some of the actions that we can take for accessing non-permitted system calls are: - // - seccomp.ActionKillThread will kill the thread that tried to use a non-permitted - // system call, but the rest of the threads can still run - // - seccomp.ActionErrno will result in returning EPERM error in all non-permitted - // system calls. - // - ActionTrap will cause a SIGSYS trap to the process. - // - // For the time being, we choose ActionTrap, but we can change this in the future. - filter := seccomp.Filter{ - // Set the threads no_new_privs bit, disabling any new child or execve - // system call to grant privileges that the parent does not have. - NoNewPrivs: true, - // Sync the filter to all threads created by the Go runtime. - Flag: seccomp.FilterFlagTSync, - Policy: seccomp.Policy{ - DefaultAction: seccomp.ActionTrap, - Syscalls: []seccomp.SyscallGroup{ - { - Action: seccomp.ActionAllow, - Names: syscalls, - }, - }, - }, - } - - err := seccomp.LoadFilter(filter) - if err != nil { - vmmLog.Error("Could not load seccomp filters") - return err - } - - vmmLog.Debug("Loaded seccomp filters") - vmmLog.WithField("allowed syscalls", syscalls).Debug("Whitelisted system calls") - - return nil -} - func (h *HVT) Signal(pid int, signal unix.Signal) error { return signalProcess(pid, signal) } @@ -186,12 +98,7 @@ func (h *HVT) BuildExecCmd(args types.ExecArgs, ukernel types.Unikernel) ([]stri } // PreExec performs pre-execution setup for HVT. -// HVT requires applying seccomp filters before syscall.Exec if Seccomp is enabled. +// Solo5-hvt applies its own seccomp filter, so there is nothing to do. func (h *HVT) PreExec(args types.ExecArgs) error { - if args.Seccomp { - if err := applySeccompFilter(); err != nil { - return err - } - } return nil } diff --git a/pkg/unikontainers/types/types.go b/pkg/unikontainers/types/types.go index be18c76f1..54d2784db 100644 --- a/pkg/unikontainers/types/types.go +++ b/pkg/unikontainers/types/types.go @@ -38,8 +38,8 @@ type VMM interface { // The returned slice contains the command path as the first element followed by arguments. BuildExecCmd(args ExecArgs, ukernel Unikernel) ([]string, error) // PreExec performs any monitor-specific setup that must happen after BuildExecCmd - // succeeds but before syscall.Exec is called. For example, HVT applies seccomp - // filters here. Most monitors can return nil (no-op). + // succeeds but before syscall.Exec is called. Most monitors can return nil + // (no-op). PreExec(args ExecArgs) error Stop(int) error Signal(int, unix.Signal) error diff --git a/pkg/unikontainers/unikontainers.go b/pkg/unikontainers/unikontainers.go index fd998d23a..41416ee62 100644 --- a/pkg/unikontainers/unikontainers.go +++ b/pkg/unikontainers/unikontainers.go @@ -930,12 +930,12 @@ func confineBlockSources(blocks []types.BlockDevParams) ([]types.BlockDevParams, // It does not return on success: // // TODO: The container can still be reported as running if the PreExec step -// (e.g., BPF/seccomp filter setup) fails after the caller reported success. We +// fails after the caller reported success. We // should find a way to handle that case as well. func execMonitor(metrics m.Writer, vmm types.VMM, execArgs types.ExecArgs, execCmd []string) error { uniklog.Debug("calling vmm execve") metrics.Capture(m.TS18) - // Perform any monitor-specific pre-exec setup (e.g., seccomp filters for HVT). + // Perform any monitor-specific pre-exec setup. err := vmm.PreExec(execArgs) if err != nil { uniklog.WithError(err).Error("failed to perform pre-exec setup") diff --git a/tests/e2e/test_cases.go b/tests/e2e/test_cases.go index 7475498a9..6c41306d3 100644 --- a/tests/e2e/test_cases.go +++ b/tests/e2e/test_cases.go @@ -114,22 +114,6 @@ func nerdctlTestCases() []containerTestArgs { Skippable: false, TestFunc: seccompTest, }, - { - Image: "harbor.nbfc.io/nubificus/urunc/redis-hvt-rumprun-raw:latest", - Name: "Hvt-rumprun-without-seccomp", - Devmapper: true, - Seccomp: false, - UID: 0, - GID: 0, - Groups: []int64{}, - Memory: "", - Cli: "", - Volumes: []containerVolume{}, - StaticNet: false, - SideContainers: []string{}, - Skippable: false, - TestFunc: seccompTest, - }, { Image: "harbor.nbfc.io/nubificus/urunc/redis-hvt-rumprun-block:latest", Name: "Hvt-rumprun-UserGroup",