Bug 1379761 moved and edited seccomp info #3020

bfallonf · 2016-10-10T06:12:08Z

Followup to #2975

@pweil- I moved the seccomp info to the admin guide, and put the Examples section more into the Configuring section, but kept the Custom Profile stuff on the outside. WDYT?

I do have some questions on areas I think can be elaborated on though. I'll put them inline. Thanks!

bfallonf · 2016-10-10T06:12:55Z

admin_guide/seccomp.adoc

+Seccomp support is achieved via two annotations in the pod configuration:
+
+* *seccomp.security.alpha.kubernetes.io/pod*: profile applies to all containers in the pod that do not override
+* *container.seccomp.security.alpha.kubernetes.io/<container name>*: container-specific profile override


@pweil- I'm not sure what the above are. Why are we configuring pods here? Is this something you have to configure before you can go through the tasks below?

both of the annotations belong at the pod level.

bfallonf · 2016-10-10T06:13:39Z

admin_guide/seccomp.adoc

+$ cat /boot/config-`uname -r` | grep CONFIG_SECCOMP=
+CONFIG_SECCOMP=y
+----
+====


Should this be inside the topics below first? Or would this be more at home in something like a "Enabling Seccomp" section instead of a admonition?

Since this is not related to OpenShift and is more about the operating system I called it out separately. I could see it going in the section below if you'd prefer it there.

bfallonf · 2016-10-10T06:15:42Z

admin_guide/seccomp.adoc

+`seccomp-profile-root` directory.
+
+If you are using the default *runtime/default* profile, you do not need to
+create one.


The above was taken over from the Examples section, but now I think I've confused it all. Is it that the file exists by default? Or is it that you have to take the file from the example inline above, so that you don't have to create it? Sorry if this is a confusing question...

If you are using runtime/default it is built into the container runtime (ie docker) and doesn't require a file on the node.

bfallonf · 2016-10-10T06:17:05Z

admin_guide/seccomp.adoc

+
+* *runtime/default*: the default profile for the container runtime (no profile on disk required)
+* *unconfined*: unconfined profile, ie, no seccomp sandboxing
+* *localhost/<profile-name>*: the profile installed to the node's local seccomp profile root


I'm not sure what the above is saying. Are they example profiles? can they be substituted into the step below this one?

these are the allowable formats of the annotation values. runtime/default is the container runtime's default, built-in profile and doesn't require a file. unconfined is turning off seccomp and doesn't require a file. localhost/<name> is pointing to a specific file on the node. The localhost portion tells the system that it is, in fact, a file that needs read and the name corresponds to the actual file name that would be stored in the seccomp profile root that was configured on the kubelet.

bfallonf · 2016-10-10T06:17:37Z

admin_guide/seccomp.adoc

+----
+
+[[seccomp-configuring-openshift-with-custom-seccomp]]
+==  Configuring {product-title} for a Custom Seccomp Profile


Please let me know if anything below is incorrect.

pweil- · 2016-10-11T13:55:31Z

admin_guide/seccomp.adoc

+
+----
+seccompProfiles:
+- runtime/default


this would be the localhost/<name> option if you wanted to use a custom profile. If you're just using the runtime/default you would not need to set the seccomp-profile-root.

pweil- · 2016-10-11T13:56:42Z

admin_guide/seccomp.adoc

+- runtime/default
+----
+
+.  Restart the node host.


this should be done after the kubelet args are changed. They just need to restart the node service(s), not the whole host.

bfallonf · 2016-10-12T06:03:23Z

@pweil- Thanks for the prompt comments. I've made the changes I think need to happen and that you've suggested, but kept some of them because your comments helped them make sense to me.

Could I ask for a final ack that all is well with the topic? Then I can move it to review. Thanks!

pweil- · 2016-10-17T12:41:51Z

admin_guide/seccomp.adoc

+    - "/your/path"
+----
+
+. Configure *seccomp-profile-root*:


This is a duplicate step of configuring the restricted SCC

@pweil- So should i delete this step in favour of the above one?

Well, reading this a bit closer I think the examples are just in the wrong spot. Here is what I see:

create a profile in the seccomp-profile-root

example of configuring the root

configure the root

example of configuring SCC

restart node

example restart

configure the SCC

example SCC

I think you just need to move lines 115-119 to replace 123-126 and then we're good.

pweil- · 2016-10-17T12:42:13Z

LGTM

bfallonf · 2016-10-18T01:02:43Z

Thanks, @pweil-

@ahardin-rh @adellape @tpoitras Should be ok to peer review now if anyone wants. Just got one thing to sort out above.

bfallonf · 2016-10-19T00:34:46Z

@pweil- I made change to what i think you suggested. Please let me know if I'm wrong.

@ahardin-rh @tpoitras @adellape totally ready for peer review.

Thanks, everybody.

pweil- · 2016-10-19T12:34:37Z

I made change to what i think you suggested. Please let me know if I'm wrong.

@bfallonf - here is what I would suggest. Everything looks good except for the example of creating a profile in the root which I think can be removed. It's a file on the host machines:

To ensure pods in your cluster run with a custom profile in the *restricted* SCC:

. Create the seccomp profile in *seccomp-profile-root* on all nodes:
+

. Configure *seccomp-profile-root*:
+
----
kubeletArguments:
  seccomp-profile-root:
    - "/your/path"
----

. Restart node service to apply the changes:

ifdef::openshift-enterprise[]
----
# systemctl restart atomic-openshift-node
----
endif::[]
ifdef::openshift-origin[]
----
# systemctl restart origin-node
----
endif::[]

* Configure the *restricted* SCC:
+
----
seccompProfiles:
- localhost/<profile-name>
----

ahardin-rh · 2016-10-19T15:19:32Z

admin_guide/seccomp.adoc

+====
+Seccomp is
+link:https://github.com/kubernetes/kubernetes/blob/release-1.4/docs/design/seccomp.md[currently
+in alpha support].


What does alpha support mean? Is it the same thing as Technology Preview?

Paul made a comment below that tech preview works.

ahardin-rh · 2016-10-19T15:24:06Z

@bfallonf just one comment from me ⭐

tpoitras · 2016-10-20T03:43:26Z

_topic_map.yml

@@ -496,6 +494,8 @@ Topics:
  - Name: Securing Builds by Strategy
    File: securing_builds
    Distros: openshift-origin,openshift-enterprise
+  - Name: Seccomp


Is this a sufficient title? Should you use the long form of "Secure Computing Mode"?

Hmm I'd changed to a better title already. Maybe I didn't push.

tpoitras · 2016-10-20T03:44:21Z

admin_guide/seccomp.adoc

+====
+Seccomp is
+link:https://github.com/kubernetes/kubernetes/blob/release-1.4/docs/design/seccomp.md[currently
+in alpha support].


I'm assuming "alpha" here means "pre-beta", but should you quantify what the risks/ramifications are?

Alpha should be defined as https://github.com/openshift/origin#alpha-and-unsupported-kubernetes-features

@pweil- What's the policy of RH? Does it mean technical preview?

The feature may have significant bugs and is suitable for testing and prototyping.

It looks like not production ready feature.

yes, tech preview

I see. Thank you!

tpoitras · 2016-10-20T03:45:01Z

admin_guide/seccomp.adoc

+in alpha support].
+====
+
+Seccomp is used to restrict the set of system calls applications can make,


Maybe the first instance you could say something like "Secure computing mode, or seccomp, is used to..."

tpoitras · 2016-10-20T03:45:34Z

admin_guide/seccomp.adoc

+in alpha support].
+====
+
+Seccomp is used to restrict the set of system calls applications can make,


s/calls applications/calls that applications

tpoitras · 2016-10-20T03:47:27Z

admin_guide/seccomp.adoc

+
+[IMPORTANT]
+====
+Containers are run with *unconfined* seccomp settings by default.


Not sure you need the "are" here.

tpoitras · 2016-10-20T03:48:20Z

admin_guide/seccomp.adoc

+== Enabling Seccomp
+
+Seccomp is a feature of the Linux kernel. To ensure seccomp is enabled on your
+system run:


comma after "system"?
Maybe not, I tend to over-use the comma.

tpoitras · 2016-10-20T03:48:52Z

admin_guide/seccomp.adoc

+
+. Create the seccomp profile. 
+
+A seccomp profile is a json file providing syscalls and the appropriate action


s/json/JSON
or
s/json/.json

tpoitras · 2016-10-20T03:49:19Z

admin_guide/seccomp.adoc

+
+. Create the seccomp profile. 
+
+A seccomp profile is a json file providing syscalls and the appropriate action


what is a "syscall"? Is this defined elsewhere?

From what I know, it's a linux thing...

tpoitras · 2016-10-20T03:51:25Z

admin_guide/seccomp.adoc

+A seccomp profile is a json file providing syscalls and the appropriate action
+to take when a syscall is invoked. The
+link:https://github.com/docker/docker/blob/master/profiles/seccomp/default.json[default
+profile] is sufficient in many cases, the cluster administrator must define the


s/in many cases, the cluster/in many cases. The cluster...

^ This should be two separate sentences, no?

tpoitras · 2016-10-20T03:51:39Z

admin_guide/seccomp.adoc

+====
+
+Seccomp is used to restrict the set of system calls applications can make,
+allowing administrators greater control over the security of workloads running


allowing cluster administrators

tpoitras · 2016-10-20T03:54:53Z

admin_guide/seccomp.adoc

+
+. Create the seccomp profile. 
+
+A seccomp profile is a json file providing syscalls and the appropriate action


This definition from "A seccomp profile" to the end of this step does not belong inside the procedure. It should be preamble under the section heading.

vikram-redhat · 2016-10-31T10:51:13Z

Sorry @adellape - I haven't had the chance to look at this today (10/31). Will look at this tomorrow in detail.

adellape · 2016-10-31T21:18:51Z

Removed enterprise-3.3 branch because it's been picked/published there already. Added dedicated-3.3 + online + to_followup labels and moved to the Next Release milestone for further conditionalizing for Dedicated/Online.

bfallonf commented Oct 10, 2016

View reviewed changes

pweil- reviewed Oct 11, 2016

View reviewed changes

bfallonf force-pushed the seccomp-1379761 branch from c0a51c3 to c22602d Compare October 12, 2016 06:00

pweil- reviewed Oct 17, 2016

View reviewed changes

bfallonf force-pushed the seccomp-1379761 branch from c22602d to 3f021be Compare October 19, 2016 00:33

bfallonf added the branch/enterprise-3.3 label Oct 19, 2016

bfallonf added this to the Next Release milestone Oct 19, 2016

ahardin-rh reviewed Oct 19, 2016

View reviewed changes

tpoitras reviewed Oct 20, 2016

View reviewed changes

adellape added branch/online to_followup branch/dedicated-3.3 and removed branch/enterprise-3.3 labels Oct 31, 2016

adellape modified the milestones: Future Release, Staging, Next Release Oct 31, 2016

adellape added branch/dedicated and removed to_followup labels Feb 2, 2017

adellape modified the milestones: OCP 3.4 GA, Next Release Feb 2, 2017

vikram-redhat modified the milestones: OCP 3.4 GA, Dedicated-Staging Mar 31, 2017

Bug 1379761 moved and edited seccomp info #3020

Bug 1379761 moved and edited seccomp info #3020

Conversation

bfallonf commented Oct 10, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bfallonf Oct 10, 2016 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bfallonf commented Oct 12, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pweil- commented Oct 17, 2016

bfallonf commented Oct 18, 2016

bfallonf commented Oct 19, 2016

pweil- commented Oct 19, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ahardin-rh commented Oct 19, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tpoitras Oct 20, 2016 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vikram-redhat commented Oct 31, 2016

adellape commented Oct 31, 2016

bfallonf Oct 10, 2016 •

edited

tpoitras Oct 20, 2016 •

edited