search

elastic / beats-docker

Official Beats Docker images
166 stars 55 forks source link

Add custom seccomp policy to journalbeat #67

Closed kvch closed 5 years ago

kvch commented 5 years ago

A new call sd_journal_wait was added to Journalbeat in https://github.com/elastic/beats/pull/9994. To perform this call, Journalbeat needs a custom seccomp profile.

I have added configuration to the template. However, I am not sure where to put the new file which stores the seccomp profile. Maybe @jarpy could you point me to the right folder to put it under?

andrewkroh commented 5 years ago

What syscall(s) does this profile whitelist that is not whitelisted by default seccomp profile used by docker? Or asked another way, what syscall does sd_journal_wait use that is being denied by Docker’s default whitelist policy?

kvch commented 5 years ago

The tool you have referred to in the README of seccomp added three additional syscalls: getrlimit, splice and wait4.

andrewkroh commented 5 years ago

The policy provided here is more restrictive that the default Docker policy. I diff'ed the two policy's and from what I see no new syscalls are white-listed therefore it's probably not worth the effort of adding a custom policy to Docker since Journalbeat will be applying a policy when it starts up.

The only reason I would add a custom policy to Docker would be if we needed to allow syscalls that are restricted by default by Docker.

The tool you have referred to in the README of seccomp added three additional syscalls: getrlimit, splice and wait4.

Did you already white-list those syscalls in Journalbeat's internal seccomp policy for amd64?

kvch commented 5 years ago

Yes, I did. So I guess this is unnecessary.