Add runtime handler seccomp profile #9424

gavinkflam · 2025-08-27T03:19:25Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

Allow configuration of a default seccomp profile per runtime.

Which issue(s) this PR fixes:

Fixes #5715

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Allow configuration of a default seccomp profile per runtime.

openshift-ci · 2025-08-27T03:19:39Z

Hi @gavinkflam. Thanks for your PR.

I'm waiting for a cri-o member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

gavinkflam · 2025-08-27T03:24:41Z

/cc saschagrunert haircommander

Please take a look if you get a chance.

codecov · 2025-08-27T03:25:17Z

Codecov Report

❌ Patch coverage is 70.96774% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.53%. Comparing base (259e23f) to head (a0a44b5).
⚠️ Report is 43 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9424      +/-   ##
==========================================
+ Coverage   65.96%   66.53%   +0.56%     
==========================================
  Files         202      202              
  Lines       27761    27994     +233     
==========================================
+ Hits        18312    18625     +313     
+ Misses       7904     7790     -114     
- Partials     1545     1579      +34

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

saschagrunert · 2025-08-27T07:26:46Z

/ok-to-test

saschagrunert

Thanks! I just have a few suggestions, otherwise LGTM

pkg/config/config.go

pkg/config/template.go

test/seccomp_runtime_handler.bats

saschagrunert

@cri-o/cri-o-maintainers PTAL, LGTM

pkg/config/config.go

gavinkflam · 2025-08-29T04:08:03Z

@saschagrunert @bitoku Please take another look. I realized that I should only apply the profile when the profile type is RuntimeDefault.

I've corrected that and added two tests to verify the profile type behavior and fallback logic.

bitoku

Thanks! overall lgtm, just one comment about validation

pkg/config/config.go

bitoku

seccomp Setup() should be closed to the receiver and shouldn't accept other Config.
Instead, how about returning the right seccomp in Runtime.Seccomp()?
I think this will make the code simpler.

Also this is nit, but it seems we can create a new function to validate seccomp. They look almost same.

gavinkflam · 2025-09-04T03:26:59Z

@bitoku To use RuntimeHandler.seccompConfig directly, we’d need to set up its notifierPath correctly. That requires APIConfig.Listen, which would mean passing the root Config struct deep into validateRuntimeSeccompProfile() - not ideal.

Instead, I’ve updated the config and Setup() to work with the seccomp.Seccomp struct directly. This makes the implementation simpler and more natural.

Let me know what do you think.

bitoku

To use RuntimeHandler.seccompConfig directly, we’d need to set up its notifierPath correctly. That requires APIConfig.Listen, which would mean passing the root Config struct deep into validateRuntimeSeccompProfile() - not ideal.

I don't think that using rootConfig is not ideal.
Cascading the value deep into validateRuntimeSeccompProfile() may look messy, but we can do just like this instead.

cri-o/pkg/config/config.go

Lines 1063 to 1065 in 51ce3dd

    
           c.seccompConfig.SetNotifierPath( 
        
           	filepath.Join(filepath.Dir(c.Listen), "seccomp"), 
        
           )

Ideally, now that runtimeHandler has seccomp profile, everything should rely on runtimeHandler seccomp profile.

But this is more style suggestion, and if there's a reason not to do that, it's not a blocker of this PR.
We could also follow up when we find a better way.

Thank you for working on it!

/lgtm

bitoku

/lgtm cancel
sorry there's one thing I missed.

server/sandbox_run_linux.go

Signed-off-by: Gavin Lam <gavin.oss@tutamail.com>

gavinkflam · 2025-09-05T05:01:54Z

@bitoku Please take another look.

I've added pod support, and implemented your suggestion of having Runtime.Seccomp() returning the right seccomp.Config.

bitoku

/lgtm

pkg/config/config.go

bitoku · 2025-09-05T12:39:47Z

@saschagrunert Can you PTAL?

openshift-ci · 2025-09-07T17:57:50Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gavinkflam, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

gavinkflam requested a review from mrunalp as a code owner August 27, 2025 03:19

openshift-ci bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/feature Categorizes issue or PR as related to a new feature. labels Aug 27, 2025

openshift-ci bot requested review from bitoku and QiWang19 August 27, 2025 03:19

openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 27, 2025

gavinkflam force-pushed the 5715-runtime-default-seccomp-profile branch from 82aa88e to 5e9e8c0 Compare August 27, 2025 03:21

openshift-ci bot requested review from haircommander and saschagrunert August 27, 2025 03:24

gavinkflam mentioned this pull request Aug 27, 2025

Configure seccomp RuntimeDefault profile based on RuntimeClass #5715

Closed

openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 27, 2025

saschagrunert reviewed Aug 27, 2025

View reviewed changes

pkg/config/config.go Show resolved Hide resolved

pkg/config/config.go Outdated Show resolved Hide resolved

pkg/config/template.go Outdated Show resolved Hide resolved

test/seccomp_runtime_handler.bats Outdated Show resolved Hide resolved

gavinkflam force-pushed the 5715-runtime-default-seccomp-profile branch 2 times, most recently from c9e819c to d0b95a8 Compare August 28, 2025 01:59

gavinkflam requested a review from saschagrunert August 28, 2025 03:19

saschagrunert reviewed Aug 28, 2025

View reviewed changes

pkg/config/config.go Show resolved Hide resolved

gavinkflam force-pushed the 5715-runtime-default-seccomp-profile branch from d0b95a8 to 417b30e Compare August 29, 2025 03:20

gavinkflam requested a review from saschagrunert August 29, 2025 04:01

bitoku reviewed Aug 29, 2025

View reviewed changes

pkg/config/config.go Outdated Show resolved Hide resolved

pkg/config/config.go Outdated Show resolved Hide resolved

gavinkflam force-pushed the 5715-runtime-default-seccomp-profile branch 3 times, most recently from c683f7e to 8d11afc Compare August 31, 2025 14:07

gavinkflam requested a review from bitoku August 31, 2025 23:08

openshift-ci bot assigned saschagrunert Sep 1, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 1, 2025

bitoku reviewed Sep 2, 2025

View reviewed changes

pkg/config/config.go Outdated Show resolved Hide resolved

pkg/config/config.go Outdated Show resolved Hide resolved

gavinkflam force-pushed the 5715-runtime-default-seccomp-profile branch from 8d11afc to 929c5dd Compare September 3, 2025 01:35

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Sep 3, 2025

gavinkflam requested a review from bitoku September 3, 2025 01:40

bitoku reviewed Sep 3, 2025

View reviewed changes

gavinkflam force-pushed the 5715-runtime-default-seccomp-profile branch from 929c5dd to 1c7208a Compare September 4, 2025 03:15

gavinkflam requested a review from bitoku September 4, 2025 03:26

bitoku reviewed Sep 4, 2025

View reviewed changes

openshift-ci bot assigned bitoku Sep 4, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 4, 2025

bitoku reviewed Sep 4, 2025

View reviewed changes

server/sandbox_run_linux.go Outdated Show resolved Hide resolved

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Sep 4, 2025

gavinkflam force-pushed the 5715-runtime-default-seccomp-profile branch from 1c7208a to 71d5047 Compare September 5, 2025 03:58

Add runtime handler seccomp profile

a0a44b5

Signed-off-by: Gavin Lam <gavin.oss@tutamail.com>

gavinkflam force-pushed the 5715-runtime-default-seccomp-profile branch from 71d5047 to a0a44b5 Compare September 5, 2025 04:47

gavinkflam requested a review from bitoku September 5, 2025 04:57

bitoku reviewed Sep 5, 2025

View reviewed changes

pkg/config/config.go Show resolved Hide resolved

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 5, 2025

saschagrunert approved these changes Sep 7, 2025

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 7, 2025

openshift-merge-bot bot merged commit aea52d6 into cri-o:main Sep 7, 2025
76 checks passed

gavinkflam deleted the 5715-runtime-default-seccomp-profile branch September 8, 2025 00:26

gavinkflam mentioned this pull request Sep 9, 2025

Add crio.runtime.runtimes seccomp_profile to crio.conf.5 doc #9458

Merged

github-actions bot mentioned this pull request Sep 14, 2025

Bump crio from v1.30.3 to v1.34.0 kokyhm/kubespray#293

Open

	c.seccompConfig.SetNotifierPath(
	filepath.Join(filepath.Dir(c.Listen), "seccomp"),
	)

Add runtime handler seccomp profile #9424

Add runtime handler seccomp profile #9424

Conversation

gavinkflam commented Aug 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

openshift-ci bot commented Aug 27, 2025

Uh oh!

gavinkflam commented Aug 27, 2025

Uh oh!

codecov bot commented Aug 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

saschagrunert commented Aug 27, 2025

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gavinkflam commented Aug 29, 2025

Uh oh!

bitoku left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bitoku left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gavinkflam commented Sep 4, 2025

Uh oh!

bitoku left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bitoku left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gavinkflam commented Sep 5, 2025

Uh oh!

bitoku left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bitoku commented Sep 5, 2025

Uh oh!

openshift-ci bot commented Sep 7, 2025

Uh oh!

Uh oh!

Uh oh!

gavinkflam commented Aug 27, 2025 •

edited

Loading

codecov bot commented Aug 27, 2025 •

edited

Loading

bitoku left a comment •

edited

Loading

bitoku left a comment •

edited

Loading