{"action":"created","comment":{"url":"https://api.github.com/repos/docker/docker/pulls/comments/70615366","id":70615366,"diff_hunk":"@@ -6,28 +6,64 @@ import (\n \t\"encoding/json\"\n \t\"fmt\"\n \n+\t\"github.com/docker/docker/pkg/stringutils\"\n \t\"github.com/docker/engine-api/types\"\n+\t\"github.com/docker/engine-api/types/versions/v1p24\"\n \t\"github.com/opencontainers/specs/specs-go\"\n+\tlibseccomp \"github.com/seccomp/libseccomp-golang\"\n )\n \n //go:generate go run -tags 'seccomp' generate.go\n \n // GetDefaultProfile returns the default seccomp profile.\n func GetDefaultProfile(rs *specs.Spec) (*specs.Seccomp, error) {\n-\treturn setupSeccomp(DefaultProfile(rs))\n+\treturn setupSeccomp(DefaultProfile(), rs)\n }\n \n // LoadProfile takes a file path and decodes the seccomp profile.\n-func LoadProfile(body string) (*specs.Seccomp, error) {\n-\tvar config types.Seccomp\n+func LoadProfile(body string, rs *specs.Spec) (*specs.Seccomp, error) {\n+\tvar (\n+\t\tconfig types.Seccomp\n+\t\terr    error\n+\t)\n \tif err := json.Unmarshal([]byte(body), &config); err != nil {\n \t\treturn nil, fmt.Errorf(\"Decoding seccomp profile failed: %v\", err)\n \t}\n+\t// try with the old profile\n+\t// TODO(runcom): this is not going to work properly:\n+\t// if I use Version == 0 in a new format seccomp profile, what's going to\n+\t// happen?\n+\tif config.Version == 0 {","path":"profiles/seccomp/seccomp.go","position":34,"original_position":34,"commit_id":"31c02e2632e072c4256425a623d567ab308584e9","original_commit_id":"cc76f2e9e677eb450e2f1768a3922cd6551416ea","user":{"login":"justincormack","id":482364,"avatar_url":"https://avatars.githubusercontent.com/u/482364?v=3","gravatar_id":"","url":"https://api.github.com/users/justincormack","html_url":"https://github.com/justincormack","followers_url":"https://api.github.com/users/justincormack/followers","following_url":"https://api.github.com/users/justincormack/following{/other_user}","gists_url":"https://api.github.com/users/justincormack/gists{/gist_id}","starred_url":"https://api.github.com/users/justincormack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justincormack/subscriptions","organizations_url":"https://api.github.com/users/justincormack/orgs","repos_url":"https://api.github.com/users/justincormack/repos","events_url":"https://api.github.com/users/justincormack/events{/privacy}","received_events_url":"https://api.github.com/users/justincormack/received_events","type":"User","site_admin":false},"body":"yes, so you either use old version which is unconditional or new unconditional one. I can start to write some docs...","created_at":"2016-07-13T12:29:02Z","updated_at":"2016-07-13T12:29:02Z","html_url":"https://github.com/docker/docker/pull/24510#discussion_r70615366","pull_request_url":"https://api.github.com/repos/docker/docker/pulls/24510","_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/comments/70615366"},"html":{"href":"https://github.com/docker/docker/pull/24510#discussion_r70615366"},"pull_request":{"href":"https://api.github.com/repos/docker/docker/pulls/24510"}}},"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/24510","id":76995085,"html_url":"https://github.com/docker/docker/pull/24510","diff_url":"https://github.com/docker/docker/pull/24510.diff","patch_url":"https://github.com/docker/docker/pull/24510.patch","issue_url":"https://api.github.com/repos/docker/docker/issues/24510","number":24510,"state":"open","locked":false,"title":"New seccomp json format","user":{"login":"runcom","id":849915,"avatar_url":"https://avatars.githubusercontent.com/u/849915?v=3","gravatar_id":"","url":"https://api.github.com/users/runcom","html_url":"https://github.com/runcom","followers_url":"https://api.github.com/users/runcom/followers","following_url":"https://api.github.com/users/runcom/following{/other_user}","gists_url":"https://api.github.com/users/runcom/gists{/gist_id}","starred_url":"https://api.github.com/users/runcom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/runcom/subscriptions","organizations_url":"https://api.github.com/users/runcom/orgs","repos_url":"https://api.github.com/users/runcom/repos","events_url":"https://api.github.com/users/runcom/events{/privacy}","received_events_url":"https://api.github.com/users/runcom/received_events","type":"User","site_admin":false},"body":"**- What I did**\r\n\r\nI've modified the json seccomp profile format to be more expressive and to allow conditionals with filters. Syscall names can now also be grouped together if they have same action,args,includes,excludes. `includes` are ORed while `excludes` are `any of`. Conditionals can be expressed on architectures and capabilities also. See following examples:\r\n\r\n```\r\n{\r\n\t\"names\": [\r\n\t\t\"accept\",\r\n\t\t\"accept4\",\r\n\t\t\"access\",\r\n\t\t\"alarm\",\r\n\t\t\"alarm\",\r\n\t\t\"bind\",\r\n\t\t\"brk\",\r\n\t\t\"capget\",\r\n\t\t\"capset\",\r\n\t\t\"chdir\",\r\n\t\t\"chmod\"\r\n\t],\r\n\t\"action\": \"SCMP_ACT_ALLOW\",\r\n\t\"args\": [],\r\n\t\"comment\": this is a comment!\"\",\r\n\t\"includes\": {},\r\n\t\"excludes\": {}\r\n},\r\n{\r\n\t\"names\": [\r\n\t\t\"iopl\",\r\n\t\t\"ioperm\"\r\n\t],\r\n\t\"action\": \"SCMP_ACT_ALLOW\",\r\n\t\"args\": [],\r\n\t\"comment\": \"\",\r\n\t\"includes\": {\r\n\t\t\"caps\": [\r\n\t\t\t\"CAP_SYS_RAWIO\"\r\n\t\t]\r\n\t},\r\n\t\"excludes\": {}\r\n},\r\n{\r\n\t\"names\": [\r\n\t\t\"clone\"\r\n\t],\r\n\t\"action\": \"SCMP_ACT_ALLOW\",\r\n\t\"args\": [{\r\n\t\t\"index\": 1,\r\n\t\t\"value\": 2080505856,\r\n\t\t\"valueTwo\": 0,\r\n\t\t\"op\": \"SCMP_CMP_MASKED_EQ\"\r\n\t}],\r\n\t\"comment\": \"\",\r\n\t\"includes\": {\r\n\t\t\"arches\": [\r\n\t\t\t\"s390\",\r\n\t\t\t\"s390x\"\r\n\t\t]\r\n\t},\r\n\t\"excludes\": {\r\n\t\t\"caps\": [\r\n\t\t\t\"CAP_SYS_ADMIN\"\r\n\t\t]\r\n\t}\r\n}\r\n```\r\n\r\n\r\n\r\n**- How I did it**\r\n\r\nvim\r\n\r\n**- How to verify it**\r\n\r\nYou can run containers with `--seccomp-profile=$DOCKERSRC/profiles/seccomp/default.json` and tweak it to verify seccomp rules are ok when running containers.\r\n\r\n**- Description for the changelog**\r\n\r\nNew seccomp json format\r\n\r\n**- A picture of a cute animal (not mandatory but encouraged)**\r\n\r\nFollowing from https://github.com/docker/docker/pull/24221, this is a proposal about defining a new and more expressive (even if more verbose) seccomp json profile.\r\n\r\n/cc @justincormack @jfrazelle @rhatdan @mheon @thaJeztah @LK4D4 \r\n\r\n**TODO:**\r\n\r\n_the stuff I've removed from this list should be done in a follow up or re-writing #24221_\r\n\r\n- [x] re-generate `profiles/seccomp/default.json`\r\n- [ ] changes in docker/engine-api after design-review\r\n- [x] add forward compatibility of the old json profile (this includes types in engine-api?)\r\n- [ ] documentation\r\n- [ ] moar tests\r\n- [ ] ~~hash based check to detect if running with Docker's default profile~~\r\n- [ ] ~~docker info enhancement from #24221~~\r\n- [ ] ~~teach the daemon to read from `/etc/docker/seccomp.json` https://github.com/docker/docker/pull/24221#issuecomment-231457809 instead of embedding the profile in code (might actually be still ok to override in daemon?)~~\r\n\r\n**NOTE**: it's not as big as it seems, the actual files changed are just 7, the rest is syscall definitions and the json :smile_cat: \r\n\r\nSigned-off-by: Antonio Murdaca <runcom@redhat.com>","created_at":"2016-07-11T17:50:25Z","updated_at":"2016-07-13T12:29:02Z","closed_at":null,"merged_at":null,"merge_commit_sha":"461919c91630e3ea07358e1cc7186650de9c6bf2","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/docker/docker/pulls/24510/commits","review_comments_url":"https://api.github.com/repos/docker/docker/pulls/24510/comments","review_comment_url":"https://api.github.com/repos/docker/docker/pulls/comments{/number}","comments_url":"https://api.github.com/repos/docker/docker/issues/24510/comments","statuses_url":"https://api.github.com/repos/docker/docker/statuses/31c02e2632e072c4256425a623d567ab308584e9","head":{"label":"runcom:new-seccomp-format","ref":"new-seccomp-format","sha":"31c02e2632e072c4256425a623d567ab308584e9","user":{"login":"runcom","id":849915,"avatar_url":"https://avatars.githubusercontent.com/u/849915?v=3","gravatar_id":"","url":"https://api.github.com/users/runcom","html_url":"https://github.com/runcom","followers_url":"https://api.github.com/users/runcom/followers","following_url":"https://api.github.com/users/runcom/following{/other_user}","gists_url":"https://api.github.com/users/runcom/gists{/gist_id}","starred_url":"https://api.github.com/users/runcom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/runcom/subscriptions","organizations_url":"https://api.github.com/users/runcom/orgs","repos_url":"https://api.github.com/users/runcom/repos","events_url":"https://api.github.com/users/runcom/events{/privacy}","received_events_url":"https://api.github.com/users/runcom/received_events","type":"User","site_admin":false},"repo":{"id":32636176,"name":"docker","full_name":"runcom/docker","owner":{"login":"runcom","id":849915,"avatar_url":"https://avatars.githubusercontent.com/u/849915?v=3","gravatar_id":"","url":"https://api.github.com/users/runcom","html_url":"https://github.com/runcom","followers_url":"https://api.github.com/users/runcom/followers","following_url":"https://api.github.com/users/runcom/following{/other_user}","gists_url":"https://api.github.com/users/runcom/gists{/gist_id}","starred_url":"https://api.github.com/users/runcom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/runcom/subscriptions","organizations_url":"https://api.github.com/users/runcom/orgs","repos_url":"https://api.github.com/users/runcom/repos","events_url":"https://api.github.com/users/runcom/events{/privacy}","received_events_url":"https://api.github.com/users/runcom/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/runcom/docker","description":"Docker - the open-source application container engine","fork":true,"url":"https://api.github.com/repos/runcom/docker","forks_url":"https://api.github.com/repos/runcom/docker/forks","keys_url":"https://api.github.com/repos/runcom/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/runcom/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/runcom/docker/teams","hooks_url":"https://api.github.com/repos/runcom/docker/hooks","issue_events_url":"https://api.github.com/repos/runcom/docker/issues/events{/number}","events_url":"https://api.github.com/repos/runcom/docker/events","assignees_url":"https://api.github.com/repos/runcom/docker/assignees{/user}","branches_url":"https://api.github.com/repos/runcom/docker/branches{/branch}","tags_url":"https://api.github.com/repos/runcom/docker/tags","blobs_url":"https://api.github.com/repos/runcom/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/runcom/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/runcom/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/runcom/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/runcom/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/runcom/docker/languages","stargazers_url":"https://api.github.com/repos/runcom/docker/stargazers","contributors_url":"https://api.github.com/repos/runcom/docker/contributors","subscribers_url":"https://api.github.com/repos/runcom/docker/subscribers","subscription_url":"https://api.github.com/repos/runcom/docker/subscription","commits_url":"https://api.github.com/repos/runcom/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/runcom/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/runcom/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/runcom/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/runcom/docker/contents/{+path}","compare_url":"https://api.github.com/repos/runcom/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/runcom/docker/merges","archive_url":"https://api.github.com/repos/runcom/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/runcom/docker/downloads","issues_url":"https://api.github.com/repos/runcom/docker/issues{/number}","pulls_url":"https://api.github.com/repos/runcom/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/runcom/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/runcom/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/runcom/docker/labels{/name}","releases_url":"https://api.github.com/repos/runcom/docker/releases{/id}","deployments_url":"https://api.github.com/repos/runcom/docker/deployments","created_at":"2015-03-21T14:55:26Z","updated_at":"2016-01-11T15:28:57Z","pushed_at":"2016-07-13T10:23:06Z","git_url":"git://github.com/runcom/docker.git","ssh_url":"git@github.com:runcom/docker.git","clone_url":"https://github.com/runcom/docker.git","svn_url":"https://github.com/runcom/docker","homepage":"http://www.docker.com","size":98765,"stargazers_count":1,"watchers_count":1,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"docker:master","ref":"master","sha":"7da11b1afda5f42d07b7304a7edcd1886434d9ed","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":7691631,"name":"docker","full_name":"docker/docker","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/docker","description":"Docker - the open-source application container engine","fork":false,"url":"https://api.github.com/repos/docker/docker","forks_url":"https://api.github.com/repos/docker/docker/forks","keys_url":"https://api.github.com/repos/docker/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/docker/teams","hooks_url":"https://api.github.com/repos/docker/docker/hooks","issue_events_url":"https://api.github.com/repos/docker/docker/issues/events{/number}","events_url":"https://api.github.com/repos/docker/docker/events","assignees_url":"https://api.github.com/repos/docker/docker/assignees{/user}","branches_url":"https://api.github.com/repos/docker/docker/branches{/branch}","tags_url":"https://api.github.com/repos/docker/docker/tags","blobs_url":"https://api.github.com/repos/docker/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/docker/languages","stargazers_url":"https://api.github.com/repos/docker/docker/stargazers","contributors_url":"https://api.github.com/repos/docker/docker/contributors","subscribers_url":"https://api.github.com/repos/docker/docker/subscribers","subscription_url":"https://api.github.com/repos/docker/docker/subscription","commits_url":"https://api.github.com/repos/docker/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/docker/contents/{+path}","compare_url":"https://api.github.com/repos/docker/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/docker/merges","archive_url":"https://api.github.com/repos/docker/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/docker/downloads","issues_url":"https://api.github.com/repos/docker/docker/issues{/number}","pulls_url":"https://api.github.com/repos/docker/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/docker/labels{/name}","releases_url":"https://api.github.com/repos/docker/docker/releases{/id}","deployments_url":"https://api.github.com/repos/docker/docker/deployments","created_at":"2013-01-18T18:10:57Z","updated_at":"2016-07-13T12:09:11Z","pushed_at":"2016-07-13T10:46:58Z","git_url":"git://github.com/docker/docker.git","ssh_url":"git@github.com:docker/docker.git","clone_url":"https://github.com/docker/docker.git","svn_url":"https://github.com/docker/docker","homepage":"http://www.docker.com","size":204540,"stargazers_count":32952,"watchers_count":32952,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":9531,"mirror_url":null,"open_issues_count":1960,"forks":9531,"open_issues":1960,"watchers":32952,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/24510"},"html":{"href":"https://github.com/docker/docker/pull/24510"},"issue":{"href":"https://api.github.com/repos/docker/docker/issues/24510"},"comments":{"href":"https://api.github.com/repos/docker/docker/issues/24510/comments"},"review_comments":{"href":"https://api.github.com/repos/docker/docker/pulls/24510/comments"},"review_comment":{"href":"https://api.github.com/repos/docker/docker/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/docker/docker/pulls/24510/commits"},"statuses":{"href":"https://api.github.com/repos/docker/docker/statuses/31c02e2632e072c4256425a623d567ab308584e9"}}}}
{"actor":{"display_login":"justincormack"}}