Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable --seccomp-use-default-when-empty by default #5587

Merged
merged 2 commits into from Mar 17, 2022
Merged

Enable --seccomp-use-default-when-empty by default #5587

merged 2 commits into from Mar 17, 2022

Conversation

saschagrunert
Copy link
Member

What type of PR is this?

/kind feature

What this PR does / why we need it:

This is a premature step before the graduation of the seccompDefault
feature planned for Kubernetes v1.25. We now use the runtime/default
profile for every workload specifying none (empty) in the pod manifest.

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

Enable `--seccomp-use-default-when-empty`/`seccomp_use_default_when_empty` by default.
This is a premature step before the graduation of the `seccompDefault` feature planned for
Kubernetes v1.25. We now use the `runtime/default` profile for every workload specifying 
none (empty) in the pod manifest.

@openshift-ci openshift-ci bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. labels Feb 2, 2022
@openshift-ci openshift-ci bot requested a review from giuseppe February 2, 2022 12:04
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Feb 2, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 2, 2022
@codecov
Copy link

codecov bot commented Feb 2, 2022 •
edited

Codecov Report

Merging #5587 (ef99de3) into main (c4c89c6) will increase coverage by 0.03%.
The diff coverage is 84.61%.

❗ Current head ef99de3 differs from pull request most recent head ea39e74. Consider uploading reports for the commit ea39e74 to get more accurate results

@@            Coverage Diff             @@
##             main    #5587      +/-   ##
==========================================
+ Coverage   43.22%   43.25%   +0.03%     
==========================================
  Files         123      123              
  Lines       12296    12225      -71     
==========================================
- Hits         5315     5288      -27     
+ Misses       6471     6430      -41     
+ Partials      510      507       -3

@saschagrunert
Copy link
Member Author

Okay this was expected:
screenshot

@haircommander
Copy link
Member

building on this, I've pushed a commit that adds a minimal seccomp profile that only blocks unshare. Possibly, we can extend it to the other syscalls in the default profile that require cap_sys_admin. This is to test whether the openshift tests still fail with a minimal profile

TomSweeneyRedHat
TomSweeneyRedHat reviewed Feb 3, 2022
View reviewed changes
Copy link
Contributor

@TomSweeneyRedHat TomSweeneyRedHat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
assuming happy tests

@saschagrunert
Copy link
Member Author

/retest-required

@saschagrunert saschagrunert force-pushed the default-when-empty-true branch 4 times, most recently from ec92028 to c14b59a Compare February 3, 2022 10:12
@saschagrunert
Copy link
Member Author

Fixed the critest suite by disabling the feature for them. I assume we have to fix this one critest with the graduation of the SeccompDefault feature in any case.

@saschagrunert
Copy link
Member Author

/test e2e-agnostic

@saschagrunert
Copy link
Member Author

/test e2e_rhel

@haircommander
Copy link
Member

openshift tests pass! I'm going to progressively try to extend the seccomp default to see what is breaking openshift tests

@haircommander haircommander force-pushed the default-when-empty-true branch 3 times, most recently from 4d61a0c to 11b0cc5 Compare February 4, 2022 15:58
@saschagrunert
Copy link
Member Author

saschagrunert commented Feb 7, 2022 •
edited

@haircommander two pods (dns and metrics scraper) seem to fail in the e2e tests. I'm going to gather the audit logs from the nodes, let's see if that works.

Does not seem to work, since /var/log/audit/audit.log is not available on the nodes:

TASK [Gather audit logs] *******************************************************
task path: /go/src/github.com/cri-o/cri-o/contrib/test/integration/e2e.yml:61
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: If you are using a module and expect the file to exist on the remote, see the remote_src option
fatal: [localhost]: FAILED! => {"changed": false, "msg": "Could not find or access '/var/log/audit/audit.log' on the Ansible Controller.\nIf you are using a module and expect the file to exist on the remote, see the remote_src option"}

@saschagrunert saschagrunert reopened this Mar 11, 2022
@openshift-ci openshift-ci bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 11, 2022
@saschagrunert
Enable --seccomp-use-default-when-empty by default
739379b 
This is a premature step before the graduation of the `seccompDefault`
feature planned for Kubernetes v1.25. We now use the `runtime/default`
profile for every workload specifying none (empty) in the pod manifest.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
@saschagrunert
Fix critest
ea39e74 
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
@openshift-ci openshift-ci bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 11, 2022
@saschagrunert
Copy link
Member Author

/retest-required

@saschagrunert
Copy link
Member Author

/retest

@littlejawa
Copy link
Contributor

littlejawa commented Mar 15, 2022 •
edited

@saschagrunert it seems the kata-jenkins job is failing on the test you modified:

11:04:23 not ok 86 ctr seccomp profiles runtime/default by empty field
11:04:23 # (in test file ctr_seccomp_kata_integration_tests.bats, line 55)
11:04:23 #   `[ "$status" -ne 0 ]' failed

We are skipping several of these tests for Kata, and I realize this one should be skipped too - your modification is not introducing a bug, it's revealing a known issue.

I will modify the kata test script to skip this additional test for now.
Please ignore this failure on this PR.

@saschagrunert
Copy link
Member Author

I will modify the kata test script to skip this additional test for now. Please ignore this failure on this PR.

Thank you!

@littlejawa littlejawa mentioned this pull request Mar 15, 2022
Closed
@littlejawa
Copy link
Contributor

/test kata-containers

@saschagrunert
Copy link
Member Author

/test integration_fedora
/test integration_rhel

@saschagrunert
Copy link
Member Author

@haircommander PTAL

@haircommander
Copy link
Member

haircommander commented Mar 16, 2022 •
edited

/lgtm

🎉 I know we aren't often in the blog writing business, but we should probably write a blog describing the change and what folks can do if their containers suddenly hit EPERM

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 16, 2022
@openshift-bot
Copy link

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@saschagrunert
Copy link
Member Author

/test e2e-gcp

@haircommander
Copy link
Member

that may not be a flake
/retest

@openshift-bot
Copy link

/retest-required

Please review the full test history for this PR and help us cut down flakes.

1 similar comment
@openshift-bot
Copy link

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@TomSweeneyRedHat
Copy link
Contributor

Unless my eyes are crossing from too many reviews today, I believe this is showing happy green test buttons....

@openshift-bot
Copy link

/retest-required

Please review the full test history for this PR and help us cut down flakes.

2 similar comments
@openshift-bot
Copy link

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot openshift-merge-robot merged commit 05fc8e3 into cri-o:main Mar 17, 2022
@saschagrunert saschagrunert deleted the default-when-empty-true branch March 17, 2022 08:04
saschagrunert added a commit to saschagrunert/cri-tools that referenced this pull request Mar 21, 2022
@saschagrunert
Fix CRI-O tests
6957918 
We switched the option `seccomp_use_default_when_empty` to `true` in
upstream which break critest. To avoid such a failure in CI we now set
it manually to `false`.

Follow-up on: cri-o/cri-o#5587

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
@saschagrunert saschagrunert mentioned this pull request Mar 21, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@TomSweeneyRedHat TomSweeneyRedHat TomSweeneyRedHat left review comments

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner

@runcom runcom Awaiting requested review from runcom

@giuseppe giuseppe Awaiting requested review from giuseppe

Assignees

@haircommander haircommander

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API kind/feature Categorizes issue or PR as related to a new feature. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@saschagrunert @haircommander @littlejawa @openshift-bot @TomSweeneyRedHat @openshift-merge-robot