diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fe4fe1651..4bea45009 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -77,7 +77,7 @@ jobs: crictl_version: 'v1.30.0' firecracker_version: 'v1.7.0' cloud_hypervisor_version: 'v50.0' - solo5_version: 'v0.9.3' + solo5_version: 'v0.12.1' hyperlight_unikraft_version: 'v0.12.1' secrets: inherit @@ -89,6 +89,6 @@ jobs: with: ref: ${{ inputs.ref }} firecracker_version: 'v1.7.0' - solo5_version: 'v0.9.3' + solo5_version: 'v0.12.1' runc_version: '1.3.0' secrets: inherit diff --git a/.github/workflows/ci_nightly.yml b/.github/workflows/ci_nightly.yml index 5766950f5..176d35791 100644 --- a/.github/workflows/ci_nightly.yml +++ b/.github/workflows/ci_nightly.yml @@ -44,7 +44,7 @@ jobs: crictl_version: 'v1.30.0' firecracker_version: 'v1.7.0' cloud_hypervisor_version: 'v50.0' - solo5_version: 'v0.9.3' + solo5_version: 'v0.12.1' hyperlight_unikraft_version: 'v0.12.1' go_version: "1.26.4" @@ -54,7 +54,7 @@ jobs: uses: ./.github/workflows/kind_test.yml with: firecracker_version: 'v1.7.0' - solo5_version: 'v0.9.3' + solo5_version: 'v0.12.1' runc_version: '1.3.0' urunc_deploy_test: diff --git a/deployment/urunc-deploy/Dockerfile b/deployment/urunc-deploy/Dockerfile index de6fe1e67..b707402e8 100644 --- a/deployment/urunc-deploy/Dockerfile +++ b/deployment/urunc-deploy/Dockerfile @@ -26,8 +26,8 @@ RUN rm -f /var/lib/dpkg/info/libc-bin.* && \ WORKDIR /app # Clone Solo5 repository and force static linking -RUN git -c http.sslVerify=false clone --branch v0.9.3 https://github.com/Solo5/solo5.git . && \ - sed -i '66 a\HOSTLDFLAGS += -static-pie' tenders/GNUmakefile +RUN git -c http.sslVerify=false clone --branch v0.12.1 https://github.com/Solo5/solo5.git . && \ + echo 'HOSTLDFLAGS += -static-pie' >> tenders/GNUmakefile # Build Solo5 and verify artifacts RUN ./configure.sh && make || true && \ diff --git a/docs/design/seccomp.md b/docs/design/seccomp.md index f1ff21373..ddd444f00 100644 --- a/docs/design/seccomp.md +++ b/docs/design/seccomp.md @@ -31,8 +31,8 @@ supported VMM. In particular, in the case of: all possible seccomp filters in Qemu. - Cloud-Hypervisor, 'urunc' makes use of the `--seccomp true` command line options to enable Cloud-Hypervisor's seccomp filters. -- Solo5-hvt, 'urunc' applies the seccomp filters before executing - 'Solo5-hvt'. +- Solo5-hvt, 'urunc' does not have to do anything more, since solo5-hvt makes use + of seccomp by itself, as of Solo5 v0.11.0. - Solo5-spt, 'urunc' can not do anything since solo5-spt makes use of seccomp by itself. @@ -42,21 +42,12 @@ Since 'urunc', in most cases, makes use of the VMM's mechanisms to enforce the seccomp filters, 'urunc' heavily relies on the VMM to properly restrict the system calls the VMM can use. -In the case of 'Solo5-hvt', since 'urunc' is responsible for applying the seccomp -filters, proper identification of the required system calls is necessary. -Unfortunately, due to dynamic linking and Go's runtime, it is +Up to Solo5 v0.10.x, 'urunc' was the one applying the seccomp filters for +'Solo5-hvt' and therefore proper identification of the required system calls was +necessary. Unfortunately, due to dynamic linking and Go's runtime, it is impossible to always predict correctly for every system the necessary system -calls for 'Solo5-hvt' execution. - -Nevertheless, 'Solo5-hvt' with seccomp in 'urunc' has been tested in Ubuntu 20.04 -and Ubuntu 22.04. Using 'urunc' and solo5-hvt on different platforms might result -in failed execution. For that reason, we strongly recommend running the seccomp -test first, by `make test_nerdctl_Seccomp`. In case the test fails, the seccomp -profile for 'Solo5-hvt' needs to get updated. - -For that reason, we created a toolset to identify the required system calls. -The toolset, along with instructions on how to use it, can be found in [goscall -repository](https://github.com/nubificus/goscall). +calls for 'Solo5-hvt' execution. Since Solo5 v0.11.0, 'Solo5-hvt' makes use of +seccomp by itself and hence 'urunc' does not have to do anything more. ## Setting a seccomp profile @@ -64,4 +55,4 @@ Due to its design, 'urunc' does not allow the definition of a seccomp profile ot than the default. However, users can totally disable seccomp by using the `--security-opt seccomp=unconfined` command line option. In that scenario, 'urunc' will not make use of any seccomp filters in all the supported VMMs, except -of 'Solo5-spt'. +of 'Solo5-hvt' and 'Solo5-spt', which make use of seccomp by themselves. diff --git a/docs/installation.md b/docs/installation.md index f0bd9ec61..332fe6224 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -318,20 +318,20 @@ file](https://github.com/urunc-dev/monitors-build?tab=readme-ov-file#how-to-use) > NOTE: Hyperlight-unikraft is not included in this bundle yet. As an example, the following commands use the -[`FC-v1.7.0_CLH-v50.0_S5-v0.9.3_VFS_-v1.13.0_QM-v10.1.1-9a44e` -release](https://github.com/urunc-dev/monitors-build/releases/tag/FC-v1.7.0_CLH-v50.0_S5-v0.9.3_VFS_-v1.13.0_QM-v10.1.1-9a44e) +[`FC-v1.7.0_CLH-v50.0_S5-v0.12.1_VFS_-v1.13.0_QM-v10.1.1-9a44e` +release](https://github.com/urunc-dev/monitors-build/releases/tag/FC-v1.7.0_CLH-v50.0_S5-v0.12.1_VFS_-v1.13.0_QM-v10.1.1-9a44e) which contains the following monitors and tools in the specified versions: - Firecracker v1.7.0 - Cloud Hypervisor v50.0 -- Solo5 v0.9.3 +- Solo5 v0.12.1 - Virtiofsd v1.13.0 - Qemu v10.1.1 To download and install the monitors in `/tmp`: ``` ARCH="$(dpkg --print-architecture)" -VERSION="FC-v1.7.0_CLH-v50.0_S5-v0.9.3_VFS_-v1.13.0_QM-v10.1.1-9a44e" +VERSION="FC-v1.7.0_CLH-v50.0_S5-v0.12.1_VFS_-v1.13.0_QM-v10.1.1-9a44e" release_url="https://github.com/urunc-dev/monitors-build/releases/download" wget ${release_url}/${VERSION}/release-${ARCH}-${VERSION}.tar.gz sudo tar Cxzvf /opt release-${ARCH}-${VERSION}.tar.gz diff --git a/docs/variables/versions.yml b/docs/variables/versions.yml index eebc7b551..c7057e67e 100644 --- a/docs/variables/versions.yml +++ b/docs/variables/versions.yml @@ -6,7 +6,7 @@ versions: qemu: "8.2.2" firecracker: "1.7.0" clh: "50.0" - solo5: "0.9.0" + solo5: "0.12.1" hyperlight-unikraft: "0.12.1" cni_plugins: "1.7.1" knative: "1.17.0" diff --git a/go.mod b/go.mod index 526ab367d..d8495c13c 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,6 @@ require ( github.com/containerd/ttrpc v1.2.9 github.com/creack/pty v1.1.24 github.com/cyphar/filepath-securejoin v0.7.0 - github.com/elastic/go-seccomp-bpf v1.6.0 github.com/hashicorp/go-version v1.9.0 github.com/jackpal/gateway v1.2.0 github.com/moby/sys/mountinfo v0.7.2 diff --git a/go.sum b/go.sum index bee2d7796..fdbd87c92 100644 --- a/go.sum +++ b/go.sum @@ -64,8 +64,6 @@ github.com/docker/go-events v0.0.0-20260608200158-dbf6103125a4 h1:Bj+mzWc7MJqqD0 github.com/docker/go-events v0.0.0-20260608200158-dbf6103125a4/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA= github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= -github.com/elastic/go-seccomp-bpf v1.6.0 h1:NYduiYxRJ0ZkIyQVwlSskcqPPSg6ynu5pK0/d7SQATs= -github.com/elastic/go-seccomp-bpf v1.6.0/go.mod h1:5tFsTvH4NtWGfpjsOQD53H8HdVQ+zSZFRUDSGevC0Kc= github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98= diff --git a/pkg/unikontainers/hypervisors/hvt.go b/pkg/unikontainers/hypervisors/hvt.go index 69cb12b91..9155b02c6 100644 --- a/pkg/unikontainers/hypervisors/hvt.go +++ b/pkg/unikontainers/hypervisors/hvt.go @@ -16,10 +16,8 @@ package hypervisors import ( "os/exec" - "runtime" "strings" - seccomp "github.com/elastic/go-seccomp-bpf" "github.com/urunc-dev/urunc/pkg/unikontainers/types" "golang.org/x/sys/unix" ) @@ -34,92 +32,6 @@ type HVT struct { binary string } -// applySeccompFilter applies some secomp filters for the Hvt process. -// By default all systemcalls will cause a SIGSYS, except the ones that we whitelist -func applySeccompFilter() error { - syscalls := []string{ - "rt_sigaction", - "ioctl", - "pread64", - "mmap", - "recvmsg", - "openat", - "sendto", - "mprotect", - "write", - "epoll_ctl", - "epoll_create1", - "read", - "close", - "fstat", - "munmap", - "brk", - "execve", - "timerfd_create", - "lseek", - "personality", - "socket", - "bind", - "getsockname", - "exit", - "exit_group", - "getpid", - "tgkill", - "nanosleep", - "futex", - "epoll_pwait", - "rt_sigreturn", - "timerfd_settime", - "pwrite64", - "set_tid_address", - "set_robust_list", - "rseq", - "prlimit64", - "getrandom", - } - - if runtime.GOARCH == "arm64" { - syscalls = append(syscalls, "faccessat", "fstatat") - } else { - syscalls = append(syscalls, "open", "stat", "access", "arch_prctl", "newfstatat") - } - // Some of the actions that we can take for accessing non-permitted system calls are: - // - seccomp.ActionKillThread will kill the thread that tried to use a non-permitted - // system call, but the rest of the threads can still run - // - seccomp.ActionErrno will result to returning EPERM error in all non-permitted - // system calls. - // - ActionTrap will cause a SIGSYS trap to the process. - // - // For the time being, we choose ActionTrap, but we can change this in the future. - filter := seccomp.Filter{ - // Set the threads no_new_privs bit, disabling any new child or execve - // system call to grant privileges that the parent does not have. - NoNewPrivs: true, - // Sync the filter to all threads created by the Go runtime. - Flag: seccomp.FilterFlagTSync, - Policy: seccomp.Policy{ - DefaultAction: seccomp.ActionTrap, - Syscalls: []seccomp.SyscallGroup{ - { - Action: seccomp.ActionAllow, - Names: syscalls, - }, - }, - }, - } - - err := seccomp.LoadFilter(filter) - if err != nil { - vmmLog.Error("Could not load seccomp filters") - return err - } - - vmmLog.Debug("Loaded seccomp filters") - vmmLog.WithField("allowed syscalls", syscalls).Debug("Whitelisted system calls") - - return nil -} - func (h *HVT) Signal(pid int, signal unix.Signal) error { return unix.Kill(pid, signal) } @@ -172,12 +84,7 @@ func (h *HVT) BuildExecCmd(args types.ExecArgs, ukernel types.Unikernel) ([]stri } // PreExec performs pre-execution setup for HVT. -// HVT requires applying seccomp filters before syscall.Exec if Seccomp is enabled. -func (h *HVT) PreExec(args types.ExecArgs) error { - if args.Seccomp { - if err := applySeccompFilter(); err != nil { - return err - } - } +// Since Solo5 0.11.0, solo5-hvt applies its own seccomp filter internally. +func (h *HVT) PreExec(_ types.ExecArgs) error { return nil } diff --git a/pkg/unikontainers/types/types.go b/pkg/unikontainers/types/types.go index f5d668b0d..24f8469c8 100644 --- a/pkg/unikontainers/types/types.go +++ b/pkg/unikontainers/types/types.go @@ -33,8 +33,8 @@ type VMM interface { // The returned slice contains the command path as the first element followed by arguments. BuildExecCmd(args ExecArgs, ukernel Unikernel) ([]string, error) // PreExec performs any monitor-specific setup that must happen after BuildExecCmd - // succeeds but before syscall.Exec is called. For example, HVT applies seccomp - // filters here. Most monitors can return nil (no-op). + // succeeds but before syscall.Exec is called. Most monitors can return nil + // (no-op). PreExec(args ExecArgs) error Stop(int) error Signal(int, unix.Signal) error diff --git a/pkg/unikontainers/unikontainers.go b/pkg/unikontainers/unikontainers.go index ad0bf2897..da5c1d302 100644 --- a/pkg/unikontainers/unikontainers.go +++ b/pkg/unikontainers/unikontainers.go @@ -748,14 +748,13 @@ func (u *Unikontainer) Exec(metrics m.Writer) error { // We send this after BuildExecCmd succeeds to avoid reporting a container // as started when the VMM command cannot be built. // TODO: The container can still be reported as running if the PreExec step - // (e.g., BPF/seccomp filter setup) fails after this point. We should find - // a way to handle that case as well. + // fails after this point. We should find a way to handle that case as well. err = u.SendMessage(StartSuccess) if err != nil { return err } - // Perform any monitor-specific pre-exec setup (e.g., seccomp filters for HVT). + // Perform any monitor-specific pre-exec setup. err = vmm.PreExec(vmmArgs) if err != nil { uniklog.WithError(err).Error("failed to perform pre-exec setup") diff --git a/tests/e2e/test_cases.go b/tests/e2e/test_cases.go index 3b90a381e..39371e1ef 100644 --- a/tests/e2e/test_cases.go +++ b/tests/e2e/test_cases.go @@ -114,22 +114,6 @@ func nerdctlTestCases() []containerTestArgs { Skippable: false, TestFunc: seccompTest, }, - { - Image: "harbor.nbfc.io/nubificus/urunc/redis-hvt-rumprun-raw:latest", - Name: "Hvt-rumprun-without-seccomp", - Devmapper: true, - Seccomp: false, - UID: 0, - GID: 0, - Groups: []int64{}, - Memory: "", - Cli: "", - Volumes: []containerVolume{}, - StaticNet: false, - SideContainers: []string{}, - Skippable: false, - TestFunc: seccompTest, - }, { Image: "harbor.nbfc.io/nubificus/urunc/redis-hvt-rumprun-block:latest", Name: "Hvt-rumprun-UserGroup",