Repository: kubernetes-sigs/security-profiles-operator
Pull request #543 (2021-07-16 09:52:07)

Update baseprofiles to recent versions
#### What type of PR is this?

/kind feature

#### What this PR does / why we need it:
Updating the baseprofile to the latest runtime versions.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?

<!--
If tests aren't applicable just write N/A.
-->
None
#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Update example base profiles to their recent runtime versions.
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/543#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov-commenter: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/543?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) Report
> Merging [#543](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/543?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (1585197) into [master](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/2f15680913311a5b6b91c2bfcaba78cf5a676c07?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (2f15680) will **not change** coverage.
> The diff coverage is `n/a`.


```diff
@@           Coverage Diff           @@
##           master     #543   +/-   ##
=======================================
  Coverage   43.75%   43.75%           
=======================================
  Files          25       25           
  Lines        1312     1312           
=======================================
  Hits          574      574           
  Misses        699      699           
  Partials       39       39           
```

k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | c5d41e4b3009c1be41e298a7735fa8e49da64e60 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/543/pull-security-profiles-operator-test-e2e/1415975721569882112) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=543). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
saschagrunert: /test pull-security-profiles-operator-test-e2e
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/543#pullrequestreview-709586858" title="LGTM">jhrozek</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/543#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/examples/baseprofile-crun.yaml b/examples/baseprofile-crun.yaml
index a26df164b..f306424f2 100644
--- a/examples/baseprofile-crun.yaml
+++ b/examples/baseprofile-crun.yaml
@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile
 metadata:
-  name: crun-v0.17
+  name: crun-v0.20.1
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
@@ -10,17 +10,45 @@ spec:
   syscalls:
   - action: SCMP_ACT_ALLOW
     names:
+    - access
     - arch_prctl
+    - brk
     - capset
+    - chdir
     - close
+    - close_range
+    - dup2
     - execve
     - exit_group
+    - fchdir
+    - fstat
+    - getcwd
+    - getegid
+    - geteuid
+    - getgid
+    - getpid
+    - getppid
+    - getuid
+    - ioctl
+    - lseek
+    - mmap
+    - mount
+    - mprotect
+    - openat
+    - openat2
+    - pivot_root
     - prctl
     - read
     - rt_sigaction
     - rt_sigprocmask
     - select
     - set_tid_address
+    - sethostname
     - setresgid
     - setresuid
+    - setsid
+    - stat
+    - statx
+    - umask
+    - umount2
     - write
diff --git a/examples/baseprofile-runc.yaml b/examples/baseprofile-runc.yaml
index de4e2fdf2..402061016 100644
--- a/examples/baseprofile-runc.yaml
+++ b/examples/baseprofile-runc.yaml
@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile
 metadata:
-  name: runc-v1.0.0-rc92
+  name: runc-v1.0.0
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
@@ -10,28 +10,48 @@ spec:
   syscalls:
   - action: SCMP_ACT_ALLOW
     names:
+    - arch_prctl
+    - brk
     - capget
     - capset
     - chdir
     - close
+    - dup3
     - epoll_ctl
     - epoll_pwait
     - execve
+    - exit_group
+    - fchdir
     - fchown
     - fcntl
     - fstat
     - fstatfs
     - futex
+    - getcwd
     - getdents64
     - getpid
     - getppid
+    - getuid
+    - ioctl
+    - mmap
+    - mount
+    - mprotect
     - nanosleep
     - newfstatat
     - openat
+    - pivot_root
     - prctl
     - read
-    - sched_yield
+    - rt_sigaction
+    - rt_sigprocmask
+    - rt_sigreturn
+    - set_tid_address
     - setgid
     - setgroups
+    - sethostname
     - setuid
+    - statfs
+    - tgkill
+    - umask
+    - umount2
     - write
diff --git a/installation-usage.md b/installation-usage.md
index b2e9d264c..351f27d9b 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -147,7 +147,7 @@ $ kubectl --namespace my-namespace get deployment myapp --output=jsonpath='{.spe
 ### Base syscalls for a container runtime
 
 An example of the minimum required syscalls for a runtime such as
-[runc](https://github.com/opencontainers/runc) (tested on version 1.0.0-rc92) to
+[runc](https://github.com/opencontainers/runc) (tested on version 1.0.0) to
 launch a container can be found in [the
 examples](./examples/baseprofile-runc.yaml). You can use this example as a
 starting point for creating custom profiles for your application. You can also
@@ -163,7 +163,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: runc-v1.0.0-rc92
+  baseProfileName: runc-v1.0.0
   syscalls:
     - action: SCMP_ACT_ALLOW
       names:
@@ -173,7 +173,7 @@ spec:
 If you're not using runc but the alternative
 [crun](https://github.com/containers/crun), then you can do the same by using
 the [corresponding example profile](./examples/baseprofile-crun.yaml) (tested
-with version 0.17).
+with version 0.20.1).
 
 ### Bind workloads to profiles with ProfileBindings
 


Test patch:
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index c61a2f761..9f0bb0ffa 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -28,11 +28,11 @@ func (e *e2e) testCaseBaseProfile([]string) {
 	e.seccompOnlyTestCase()
 
 	baseProfilePath := "examples/baseprofile-runc.yaml"
-	baseProfileName := "runc-v1.0.0-rc92"
+	baseProfileName := "runc-v1.0.0"
 
 	if clusterType == clusterTypeVanilla {
 		baseProfilePath = "examples/baseprofile-crun.yaml"
-		baseProfileName = "crun-v0.17"
+		baseProfileName = "crun-v0.20.1"
 	}
 
 	helloProfile := fmt.Sprintf(`