Repository: kubernetes-sigs/security-profiles-operator
Pull request #292 (2021-02-11 09:04:22)

Make crun the default runtime for CRI-O tests
#### What type of PR is this?

/kind cleanup

#### What this PR does / why we need it:
We can now switch back to crun (instead of using runc) for the vagrant
based tests since the nginx profile fix got merged and we scope the
tests to only a subset of features which are avilable on Fedora/CRI-O.

#### Which issue(s) this PR fixes:
None
<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->

#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/292#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/examples/baseprofile-crun.yaml b/examples/baseprofile-crun.yaml
new file mode 100644
index 000000000..dc1aedb74
--- /dev/null
+++ b/examples/baseprofile-crun.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
+kind: SeccompProfile
+metadata:
+  name: crun-v0.17
+spec:
+  defaultAction: SCMP_ACT_ERRNO
+  targetWorkload: base
+  architectures:
+  - SCMP_ARCH_X86_64
+  syscalls:
+  - action: SCMP_ACT_ALLOW
+    names:
+    - arch_prctl
+    - capset
+    - close
+    - execve
+    - exit_group
+    - prctl
+    - read
+    - rt_sigaction
+    - rt_sigprocmask
+    - select
+    - set_tid_address
+    - setresgid
+    - setresuid
+    - write
diff --git a/examples/baseprofile.yaml b/examples/baseprofile-runc.yaml
similarity index 100%
rename from examples/baseprofile.yaml
rename to examples/baseprofile-runc.yaml
diff --git a/hack/ci/install-cri-o.sh b/hack/ci/install-cri-o.sh
index 994dbce26..a61682c65 100755
--- a/hack/ci/install-cri-o.sh
+++ b/hack/ci/install-cri-o.sh
@@ -53,6 +53,14 @@ conmon_cgroup = "pod"
 cgroup_manager = "cgroupfs"
 EOT
 
+cat <<EOT >>/etc/crio/crio.conf.d/20-crun.conf
+[crio.runtime]
+default_runtime = "crun"
+
+[crio.runtime.runtimes.crun]
+runtime_path = "/usr/local/bin/crun"
+EOT
+
 chcon -R -u system_u -r object_r -t container_config_t \
     /etc/crio \
     /etc/crio/crio.conf \
diff --git a/installation-usage.md b/installation-usage.md
index c691c3ab5..610d0c69d 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -114,10 +114,11 @@ $ kubectl --namespace my-namespace get deployment myapp --output=jsonpath='{.spe
 
 #### Base syscalls for a container runtime
 
-An example of the minimum required syscalls for a runtime such as runc (tested
-on version 1.0.0-rc92) to launch a container can be found in [the
-examples](./examples/baseprofile.yaml). You can use this example as a starting
-point for creating custom profiles for your application. You can also
+An example of the minimum required syscalls for a runtime such as
+[runc](https://github.com/opencontainers/runc) (tested on version 1.0.0-rc92) to
+launch a container can be found in [the
+examples](./examples/baseprofile-runc.yaml). You can use this example as a
+starting point for creating custom profiles for your application. You can also
 programmatically combine it with your custom profiles in order to build
 application-specific profiles that only specify syscalls that are required on
 top of the base calls needed for the container runtime. For example:
@@ -138,6 +139,11 @@ spec:
         - exit_group
 ```
 
+If you're not using runc but the alternative
+[crun](https://github.com/containers/crun), then you can do the same by using
+the [corresponding example profile](./examples/baseprofile-crun.yaml) (tested
+with version 0.17).
+
 #### Bind workloads to profiles with ProfileBindings
 
 If you do not want to directly modify the SecurityContext of a Pod, for instance


Test patch:
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index 8e36208e8..f1019987d 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -25,7 +25,7 @@ import (
 
 func (e *e2e) testCaseBaseProfile([]string) {
 	e.seccompOnlyTestCase()
-	const baseProfilePath = "examples/baseprofile.yaml"
+	const baseProfilePath = "examples/baseprofile-runc.yaml"
 	const helloProfile = `
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile