Make seccomp code re-usable

[saschagrunert]

Hey runc maintainers 👋, I really would like to re-use the runc seccomp profile validation in libcontainer/seccomp/seccomp_linux.go, but without loading the profile at all. This could be re-used for higher level profile validation in other libraries.

My proposal would be that we move most of the code into a different library or make it public in libcontainer. Both approaches would mean a refactoring of the API in any case. I'm thinking about two new functions:

• ValidateSeccompProfile(profile string) - unmarshal the profile into the Seccomp struct and try BuildFilter()
• BuildFilter(profile *Seccomp) - validates the profile further and builds the filter

InitSeccomp(*Seccomp) would then also use BuildFilter() but additionally runs filter.Load().

What do you think about this? I think this way we could also work on better testing around the seccomp profile validation.

[kolyshkin]

I'm strongly against introducing any more public interfaces into runc (we have yet to fix the ones we have, and we have plenty).

A separate library (under opencontainers I guess) looks good to me.

[saschagrunert]

A separate library (under opencontainers I guess) looks good to me.

I'm in favor of that too. I also see that the runtime-spec introduces some seccomp types which might be re-used as well.

[rhatdan]

We just created github.com/containers/pkg/seccomp, How about just adding it there.

[saschagrunert]

We just created github.com/containers/pkg/seccomp, How about just adding it there.

Do you mean github.com/containers/common/pkg/seccomp ? Yes I would prefer that location, too.

[rhatdan]

Yes

[saschagrunert]

Sounds good, the corresponding PR is there: containers/common#296