Bug 2082924

Summary: moby-engine: docker security options missing seccomp support
Product: [Fedora] Fedora Reporter: Jia Yuan Lo <jylo06g>
Component: moby-engineAssignee: Maxwell G <maxwell>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 35CC: maxwell, o.lemasle
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: moby-engine-20.10.15-1.fc37 moby-engine-20.10.15-1.fc36 moby-engine-20.10.16-1.fc34 moby-engine-20.10.16-1.fc35 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-05-08 21:09:35 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jia Yuan Lo 2022-05-08 15:10:32 UTC
Description of problem:
https://docs.docker.com/engine/security/seccomp/
https://stackoverflow.com/questions/43820037/docker-seccomp-not-working-on-kali

When trying to use `docker run` with
--security-opt seccomp=/path/to/seccomp/profile.json
will result in
docker: Error response from daemon: seccomp profiles are not supported on this daemon, you cannot specify a custom seccomp profile.

Version-Release number of selected component (if applicable):
20.10.14-1.fc35

How reproducible:
10/10

Steps to Reproduce:
1. Install docker / moby-engine
2. docker run --security-opt seccomp=...

Actual results:
Docker shows error:
docker: Error response from daemon: seccomp profiles are not supported on this daemon, you cannot specify a custom seccomp profile.

Expected results:
Docker should able to use seccomp feature

Additional info:
Note that security options field is missing seccomp, I am not sure what went wrong.
I already installed a new enough libseccomp-2.5.3-1.fc35.x86_64 so it shouldnt be a problem, according to the stackoverflow post...

$ sudo docker info
Client:
 Context:    default
 Debug Mode: false

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 1
 Server Version: 20.10.14
 Storage Driver: btrfs
  Build Version: Btrfs v5.16.2 
  Library Version: 102
 Logging Driver: journald
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: /usr/libexec/docker/docker-init
 containerd version: 
 runc version: babb8ce-dirty
 init version: 
 Security Options:
  selinux
  cgroupns
 Kernel Version: 5.17.5-200.fc35.x86_64
 Operating System: Fedora Linux 35 (Workstation Edition)
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 11.5GiB
 Name: t430-2022-04-10
 ID: HWE3:NRU4:F63J:YFGU:LVNB:7OT2:SW7M:EOYP:IC2T:UNKB:WD6F:66JA
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: true

Comment 1 Fedora Update System 2022-05-08 20:54:59 UTC
FEDORA-2022-4f8cf975b5 has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-4f8cf975b5

Comment 2 Fedora Update System 2022-05-08 20:55:04 UTC
FEDORA-2022-ec3d3c0f08 has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2022-ec3d3c0f08

Comment 3 Fedora Update System 2022-05-08 20:55:06 UTC
FEDORA-2022-7c689c0f27 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2022-7c689c0f27

Comment 4 Maxwell G 2022-05-08 20:56:06 UTC
Please confirm that the update solves your issue.

Comment 5 Fedora Update System 2022-05-08 21:08:05 UTC
FEDORA-2022-6bae7ff718 has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2022-6bae7ff718

Comment 6 Fedora Update System 2022-05-08 21:09:35 UTC
FEDORA-2022-6bae7ff718 has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Fedora Update System 2022-05-09 02:05:17 UTC
FEDORA-2022-ec3d3c0f08 has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-ec3d3c0f08`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-ec3d3c0f08

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2022-05-09 02:24:51 UTC
FEDORA-2022-7c689c0f27 has been pushed to the Fedora 34 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-7c689c0f27`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-7c689c0f27

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2022-05-09 02:55:23 UTC
FEDORA-2022-4f8cf975b5 has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-4f8cf975b5`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-4f8cf975b5

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2022-05-12 20:25:26 UTC
FEDORA-2022-4f8cf975b5 has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 11 Jia Yuan Lo 2022-05-14 00:14:30 UTC
Thanks! Confirmed fixed in moby-engine-20.10.16-1.fc35. Seccomp support is now listed under Security Options.

$ sudo docker info
Client:
 Context:    default
 Debug Mode: false

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 1
 Server Version: 20.10.15
 Storage Driver: btrfs
  Build Version: Btrfs v5.16.2 
  Library Version: 102
 Logging Driver: journald
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: /usr/libexec/docker/docker-init
 containerd version: 
 runc version: babb8ce-dirty
 init version: 
 Security Options:
  seccomp
   Profile: default
  selinux
  cgroupns
 Kernel Version: 5.17.6-200.fc35.x86_64
 Operating System: Fedora Linux 35 (Workstation Edition)
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 11.5GiB
 Name: t430-2022-04-10
 ID: HWE3:NRU4:F63J:YFGU:LVNB:7OT2:SW7M:EOYP:IC2T:UNKB:WD6F:66JA
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: true

Comment 12 Maxwell G 2022-05-14 01:22:11 UTC
Thanks for testing the update and initially notiticing the bug. I inadvertently introduced this regression when I updated the specfile to use `%gobuild` instead of upstream's Makefile.

Comment 13 Fedora Update System 2022-05-14 02:24:21 UTC
FEDORA-2022-dfd30078e1 has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-dfd30078e1`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-dfd30078e1

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 14 Fedora Update System 2022-05-14 02:40:48 UTC
FEDORA-2022-f220458e6b has been pushed to the Fedora 34 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-f220458e6b`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-f220458e6b

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 15 Fedora Update System 2022-05-22 00:39:32 UTC
FEDORA-2022-f220458e6b has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 16 Fedora Update System 2022-05-22 01:23:16 UTC
FEDORA-2022-dfd30078e1 has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.