Repository: kubernetes-sigs/security-profiles-operator
Pull request #291 (2021-02-11 08:45:55)

Add minimum profile example for crun
#### What type of PR is this?

/kind feature

#### What this PR does / why we need it:
We now add a `baseprofile-crun.yaml` which contains the minimum amount of
syscalls required to run a workload. This is now mentioned in the
installation guide, too.

#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Added minimum [crun](https://github.com/containers/crun) base profile
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/291#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov-io: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/291?src=pr&el=h1) Report
> Merging [#291](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/291?src=pr&el=desc) (2c79e12) into [master](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/e816cd073b4bb65bdf30641855079701ecf7855b?el=desc) (e816cd0) will **not change** coverage.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/291/graphs/tree.svg?width=650&height=150&src=pr&token=37VIWSZ1ZT)](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/291?src=pr&el=tree)

```diff
@@           Coverage Diff           @@
##           master     #291   +/-   ##
=======================================
  Coverage   25.48%   25.48%           
=======================================
  Files           8        8           
  Lines         616      616           
=======================================
  Hits          157      157           
  Misses        441      441           
  Partials       18       18           
```

| Flag | Coverage Δ | |
|---|---|---|
| unittests | `25.48% <ø> (ø)` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags#carryforward-flags-in-the-pull-request-comment) to find out more.


------

[Continue to review full report at Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/291?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/291?src=pr&el=footer). Last update [e816cd0...2c79e12](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/291?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

JAORMX: /lgtm

Patch:
diff --git a/examples/baseprofile-crun.yaml b/examples/baseprofile-crun.yaml
new file mode 100644
index 000000000..dc1aedb74
--- /dev/null
+++ b/examples/baseprofile-crun.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
+kind: SeccompProfile
+metadata:
+  name: crun-v0.17
+spec:
+  defaultAction: SCMP_ACT_ERRNO
+  targetWorkload: base
+  architectures:
+  - SCMP_ARCH_X86_64
+  syscalls:
+  - action: SCMP_ACT_ALLOW
+    names:
+    - arch_prctl
+    - capset
+    - close
+    - execve
+    - exit_group
+    - prctl
+    - read
+    - rt_sigaction
+    - rt_sigprocmask
+    - select
+    - set_tid_address
+    - setresgid
+    - setresuid
+    - write
diff --git a/examples/baseprofile.yaml b/examples/baseprofile-runc.yaml
similarity index 100%
rename from examples/baseprofile.yaml
rename to examples/baseprofile-runc.yaml
diff --git a/installation-usage.md b/installation-usage.md
index c691c3ab5..610d0c69d 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -114,10 +114,11 @@ $ kubectl --namespace my-namespace get deployment myapp --output=jsonpath='{.spe
 
 #### Base syscalls for a container runtime
 
-An example of the minimum required syscalls for a runtime such as runc (tested
-on version 1.0.0-rc92) to launch a container can be found in [the
-examples](./examples/baseprofile.yaml). You can use this example as a starting
-point for creating custom profiles for your application. You can also
+An example of the minimum required syscalls for a runtime such as
+[runc](https://github.com/opencontainers/runc) (tested on version 1.0.0-rc92) to
+launch a container can be found in [the
+examples](./examples/baseprofile-runc.yaml). You can use this example as a
+starting point for creating custom profiles for your application. You can also
 programmatically combine it with your custom profiles in order to build
 application-specific profiles that only specify syscalls that are required on
 top of the base calls needed for the container runtime. For example:
@@ -138,6 +139,11 @@ spec:
         - exit_group
 ```
 
+If you're not using runc but the alternative
+[crun](https://github.com/containers/crun), then you can do the same by using
+the [corresponding example profile](./examples/baseprofile-crun.yaml) (tested
+with version 0.17).
+
 #### Bind workloads to profiles with ProfileBindings
 
 If you do not want to directly modify the SecurityContext of a Pod, for instance


Test patch:
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index 8e36208e8..f1019987d 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -25,7 +25,7 @@ import (
 
 func (e *e2e) testCaseBaseProfile([]string) {
 	e.seccompOnlyTestCase()
-	const baseProfilePath = "examples/baseprofile.yaml"
+	const baseProfilePath = "examples/baseprofile-runc.yaml"
 	const helloProfile = `
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile