Documentation
¶
Index ¶
- Constants
- func DefaultArchitectures() []string
- func ProfileToJSON(profile *SeccompProfile) (string, error)
- func SaveAppArmorProfile(profile *AppArmorProfile, path string) error
- func SaveProfile(profile *SeccompProfile, path string) error
- func ValidateProfile(profile *SeccompProfile) error
- type AppArmorManager
- type AppArmorProfile
- type SeccompArg
- type SeccompProfile
- func ARMProfile() *SeccompProfile
- func AndroidProfile() *SeccompProfile
- func DefaultProfile() *SeccompProfile
- func LoadProfile(path string) (*SeccompProfile, error)
- func MergeProfiles(profiles ...*SeccompProfile) *SeccompProfile
- func PrivilegedProfile() *SeccompProfile
- func ProfileFromJSON(jsonStr string) (*SeccompProfile, error)
- func UnconfinedProfile() *SeccompProfile
- type SeccompSyscall
Constants ¶
const ( ActKill = "SCMP_ACT_KILL" ActKillProcess = "SCMP_ACT_KILL_PROCESS" ActTrap = "SCMP_ACT_TRAP" ActErrno = "SCMP_ACT_ERRNO" ActTrace = "SCMP_ACT_TRACE" ActAllow = "SCMP_ACT_ALLOW" ActLog = "SCMP_ACT_LOG" ArchX86 = "SCMP_ARCH_X86" ArchX86_64 = "SCMP_ARCH_X86_64" ArchARM = "SCMP_ARCH_ARM" ArchAARCH64 = "SCMP_ARCH_AARCH64" ArchMIPS = "SCMP_ARCH_MIPS" ArchMIPS64 = "SCMP_ARCH_MIPS64" ArchPPC64LE = "SCMP_ARCH_PPC64LE" ArchS390X = "SCMP_ARCH_S390X" ArchRISCV64 = "SCMP_ARCH_RISCV64" OpNotEqual = "SCMP_CMP_NE" OpLessThan = "SCMP_CMP_LT" OpLessEqual = "SCMP_CMP_LE" OpEqualTo = "SCMP_CMP_EQ" OpGreaterEqual = "SCMP_CMP_GE" OpGreaterThan = "SCMP_CMP_GT" OpMaskedEqual = "SCMP_CMP_MASKED_EQ" )
Seccomp constants.
Variables ¶
This section is empty.
Functions ¶
func DefaultArchitectures ¶
func DefaultArchitectures() []string
DefaultArchitectures returns the default architectures for a seccomp profile.
func ProfileToJSON ¶
func ProfileToJSON(profile *SeccompProfile) (string, error)
ProfileToJSON converts a profile to JSON string.
func SaveAppArmorProfile ¶
func SaveAppArmorProfile(profile *AppArmorProfile, path string) error
SaveAppArmorProfile saves an AppArmor profile to a file.
func SaveProfile ¶
func SaveProfile(profile *SeccompProfile, path string) error
SaveProfile saves a seccomp profile to a JSON file.
func ValidateProfile ¶
func ValidateProfile(profile *SeccompProfile) error
ValidateProfile validates a seccomp profile.
Types ¶
type AppArmorManager ¶
type AppArmorManager struct {
// contains filtered or unexported fields
}
AppArmorManager manages AppArmor profiles.
func NewAppArmorManager ¶
func NewAppArmorManager() *AppArmorManager
NewAppArmorManager creates a new AppArmor manager.
func (*AppArmorManager) ApplyProfile ¶
func (m *AppArmorManager) ApplyProfile(name string) error
ApplyProfile applies an AppArmor profile to the current process.
func (*AppArmorManager) IsAvailable ¶
func (m *AppArmorManager) IsAvailable() bool
IsAvailable checks if AppArmor is available on the system.
func (*AppArmorManager) LoadProfile ¶
func (m *AppArmorManager) LoadProfile(profile *AppArmorProfile) error
LoadProfile loads an AppArmor profile into the kernel.
func (*AppArmorManager) UnloadProfile ¶
func (m *AppArmorManager) UnloadProfile(name string) error
UnloadProfile unloads an AppArmor profile from the kernel.
type AppArmorProfile ¶
type AppArmorProfile struct {
Name string `json:"name"`
Content string `json:"content"`
Mode string `json:"mode"` // enforce, complain, unconfined
}
AppArmorProfile represents an AppArmor profile.
func CustomProfile ¶
func CustomProfile(name string, rules []string) *AppArmorProfile
CustomProfile creates a custom AppArmor profile with specific rules.
func DefaultAppArmorProfile ¶
func DefaultAppArmorProfile() *AppArmorProfile
DefaultProfile returns the default AppArmor profile for containers.
func LoadAppArmorProfile ¶
func LoadAppArmorProfile(path string) (*AppArmorProfile, error)
LoadAppArmorProfile loads an AppArmor profile from a file.
func UnconfinedAppArmorProfile ¶
func UnconfinedAppArmorProfile() *AppArmorProfile
UnconfinedProfile returns an unconfined AppArmor profile.
type SeccompArg ¶
type SeccompArg struct {
Index uint `json:"index"`
Value uint64 `json:"value"`
ValueTwo uint64 `json:"valueTwo,omitempty"`
Op string `json:"op"`
}
SeccompArg represents a seccomp syscall argument filter.
type SeccompProfile ¶
type SeccompProfile struct {
DefaultAction string `json:"defaultAction"`
Architectures []string `json:"architectures,omitempty"`
Syscalls []SeccompSyscall `json:"syscalls,omitempty"`
Flags []string `json:"flags,omitempty"`
ListenerPath string `json:"listenerPath,omitempty"`
ListenerMetadata map[string]string `json:"listenerMetadata,omitempty"`
}
SeccompProfile represents a seccomp profile.
func ARMProfile ¶
func ARMProfile() *SeccompProfile
ARMProfile returns a seccomp profile optimized for ARM devices.
func AndroidProfile ¶
func AndroidProfile() *SeccompProfile
AndroidProfile returns a seccomp profile optimized for Android. It allows Android-specific syscalls while blocking dangerous ones.
func DefaultProfile ¶
func DefaultProfile() *SeccompProfile
DefaultProfile returns the default seccomp profile for containers. This is similar to Docker's default profile.
func LoadProfile ¶
func LoadProfile(path string) (*SeccompProfile, error)
LoadProfile loads a seccomp profile from a JSON file.
func MergeProfiles ¶
func MergeProfiles(profiles ...*SeccompProfile) *SeccompProfile
MergeProfiles merges multiple seccomp profiles. Later profiles override earlier ones.
func PrivilegedProfile ¶
func PrivilegedProfile() *SeccompProfile
PrivilegedProfile returns a permissive seccomp profile for privileged containers.
func ProfileFromJSON ¶
func ProfileFromJSON(jsonStr string) (*SeccompProfile, error)
ProfileFromJSON converts a JSON string to a profile.
func UnconfinedProfile ¶
func UnconfinedProfile() *SeccompProfile
UnconfinedProfile returns a completely unconfined seccomp profile.
func (*SeccompProfile) String ¶
func (p *SeccompProfile) String() string
String returns a human-readable summary of the profile.
type SeccompSyscall ¶
type SeccompSyscall struct {
Names []string `json:"names"`
Action string `json:"action"`
Args []SeccompArg `json:"args,omitempty"`
Comment string `json:"comment,omitempty"`
}
SeccompSyscall represents a seccomp syscall rule.
Source Files