Seccomp profile policy enforcement. (#1705)

This commit adds enforcement over the seccomp profile associated with a container. The
policy author can measure their seccomp profile and include this measurement in the
policy. Subsequently, they can provided that same seccomp profile to the orchestrator
(e.g. via an annotation) and GCS will measure the provided profile and provide this as
input to the policy engine.

This commit also adds a series of CRI tests for security context enforcement.

Fixing error with privileged exec_in_container
Adding CRI test for privileged exec in container

Signed-off-by: Matthew A Johnson <matjoh@microsoft.com>

internal/guest/runtime/hcsv2/uvm.go

@@ -389,6 +389,11 @@ func (h *Host) CreateContainer(ctx context.Context, id string, settings *prot.VM
 		return nil, err
 	}
 
+	seccomp, err := securitypolicy.MeasureSeccompProfile(settings.OCISpecification.Linux.Seccomp)
+	if err != nil {
+		return nil, err
+	}
+
 	envToKeep, capsToKeep, allowStdio, err := h.securityPolicyEnforcer.EnforceCreateContainerPolicy(
 		sandboxID,
 		id,
@@ -402,6 +407,7 @@ func (h *Host) CreateContainer(ctx context.Context, id string, settings *prot.VM
 		groups,
 		umask,
 		settings.OCISpecification.Process.Capabilities,
+		seccomp,
 	)
 	if err != nil {
 		return nil, errors.Wrapf(err, "container creation denied due to policy")

internal/hcsoci/hcsdoc_lcow.go

@@ -9,11 +9,13 @@ import (
 
 	hcsschema "github.com/Microsoft/hcsshim/internal/hcs/schema2"
 	"github.com/Microsoft/hcsshim/internal/log"
+	"github.com/Microsoft/hcsshim/internal/oci"
 	"github.com/Microsoft/hcsshim/internal/schemaversion"
+	"github.com/Microsoft/hcsshim/pkg/annotations"
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 )
 
-func createLCOWSpec(coi *createOptionsInternal) (*specs.Spec, error) {
+func createLCOWSpec(ctx context.Context, coi *createOptionsInternal) (*specs.Spec, error) {
 	// Remarshal the spec to perform a deep copy.
 	j, err := json.Marshal(coi.Spec)
 	if err != nil {
@@ -45,7 +47,10 @@ func createLCOWSpec(coi *createOptionsInternal) (*specs.Spec, error) {
 		spec.Linux.Resources.HugepageLimits = nil
 		spec.Linux.Resources.Network = nil
 	}
-	spec.Linux.Seccomp = nil
+
+	if oci.ParseAnnotationsBool(ctx, spec.Annotations, annotations.LCOWPrivileged, false) {
+		spec.Linux.Seccomp = nil
+	}
 
 	return spec, nil
 }
@@ -84,7 +89,7 @@ type linuxHostedSystem struct {
 }
 
 func createLinuxContainerDocument(ctx context.Context, coi *createOptionsInternal, guestRoot, scratchPath string) (*linuxHostedSystem, error) {
-	spec, err := createLCOWSpec(coi)
+	spec, err := createLCOWSpec(ctx, coi)
 	if err != nil {
 		return nil, err
 	}

internal/tools/securitypolicy/helpers/helpers.go

@@ -1,14 +1,18 @@
 package helpers
 
 import (
+	"encoding/json"
 	"fmt"
+	"log"
+	"os"
 	"strconv"
 	"strings"
 
 	"github.com/google/go-containerregistry/pkg/authn"
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/opencontainers/runtime-spec/specs-go"
 
 	"github.com/Microsoft/hcsshim/ext4/tar2ext4"
 	sp "github.com/Microsoft/hcsshim/pkg/securitypolicy"
@@ -234,6 +238,7 @@ func PolicyContainersFromConfigs(containerConfigs []sp.ContainerConfig) ([]*sp.C
 			!containerConfig.AllowPrivilegeEscalation,
 			setDefaultUser(containerConfig.User, user, group),
 			setDefaultCapabilities(containerConfig.Capabilities),
+			setDefaultSeccomp(containerConfig.SeccompProfilePath),
 		)
 		if err != nil {
 			return nil, err
@@ -282,3 +287,28 @@ func setDefaultCapabilities(config *sp.CapabilitiesConfig) *sp.CapabilitiesConfi
 
 	return config
 }
+
+func setDefaultSeccomp(seccompProfilePath string) string {
+	if len(seccompProfilePath) == 0 {
+		return ""
+	}
+
+	var seccomp specs.LinuxSeccomp
+
+	buff, err := os.ReadFile(seccompProfilePath)
+	if err != nil {
+		log.Fatalf("unable to read seccomp profile: %v", err)
+	}
+
+	err = json.Unmarshal(buff, &seccomp)
+	if err != nil {
+		log.Fatalf("unable to parse seccomp profile: %v", err)
+	}
+
+	profileSHA256, err := sp.MeasureSeccompProfile(&seccomp)
+	if err != nil {
+		log.Fatalf("unable to measure seccomp profile: %v", err)
+	}
+
+	return profileSHA256
+}