grpc: Add seccomp status to guest details

Add a boolean showing whether seccomp support is available to the
`AgentDetails` message returned by `GetGuestDetails()`. If set,
it indicates that full seccomp support [*] is available.

Fixes kata-containers#381.

[*] - Both the agent and the environment it is running in support seccomp.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>

Makefile

@@ -45,7 +45,8 @@ AGENT_IMAGE := katacontainers/agent-dev
 AGENT_TAG := $(if $(COMMIT_NO_SHORT),$(COMMIT_NO_SHORT),dev)
 
 $(TARGET): $(GENERATED_FILES) $(SOURCES) $(VERSION_FILE)
-	go build -tags "$(BUILDTAGS)" -o $@ -ldflags "-X main.version=$(VERSION_COMMIT)"
+	go build -tags "$(BUILDTAGS)" -o $@ \
+		-ldflags "-X main.version=$(VERSION_COMMIT) -X main.seccompSupport=$(SECCOMP)"
 
 install:
 	install -D $(TARGET) $(DESTDIR)$(BINDIR)/$(TARGET)

agent.go

@@ -49,6 +49,9 @@ var (
 	cgroupMemoryPath             = cgroupPath + "/memory"
 	cgroupMemoryUseHierarchyPath = cgroupMemoryPath + "/memory.use_hierarchy"
 	cgroupMemoryUseHierarchyMode = os.FileMode(0400)
+
+	// Set by the build
+	seccompSupport string
 )
 
 var initRootfsMounts = []initMount{

grpc.go

@@ -24,6 +24,7 @@ import (
 	pb "github.com/kata-containers/agent/protocols/grpc"
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/configs"
+	"github.com/opencontainers/runc/libcontainer/seccomp"
 	"github.com/opencontainers/runc/libcontainer/specconv"
 	"github.com/opencontainers/runc/libcontainer/utils"
 	"github.com/opencontainers/runtime-spec/specs-go"
@@ -1334,10 +1335,19 @@ func (a *agentGRPC) GetGuestDetails(ctx context.Context, req *pb.GuestDetailsReq
 	return &details, nil
 }
 
+func (a *agentGRPC) haveSeccomp() bool {
+	if seccompSupport == "yes" && seccomp.IsEnabled() {
+		return true
+	}
+
+	return false
+}
+
 func (a *agentGRPC) getAgentDetails(ctx context.Context) *pb.AgentDetails {
 	details := pb.AgentDetails{
-		Version:    version,
-		InitDaemon: os.Getpid() == 1,
+		Version:         version,
+		InitDaemon:      os.Getpid() == 1,
+		SupportsSeccomp: a.haveSeccomp(),
 	}
 
 	for handler := range deviceHandlerList {

grpc_test.go

@@ -23,6 +23,7 @@ import (
 	pb "github.com/kata-containers/agent/protocols/grpc"
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/configs"
+	"github.com/opencontainers/runc/libcontainer/seccomp"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/stretchr/testify/assert"
 )
@@ -624,7 +625,7 @@ func TestMultiWaitProcess(t *testing.T) {
 	wg.Wait()
 }
 
-func testAgentDetails(assert *assert.Assertions, details *pb.AgentDetails) {
+func testAgentDetails(assert *assert.Assertions, details *pb.AgentDetails, haveSeccomp bool) {
 	assert.NotNil(details)
 
 	assert.Equal(details.Version, version)
@@ -649,6 +650,8 @@ func testAgentDetails(assert *assert.Assertions, details *pb.AgentDetails) {
 
 	assert.Equal(details.DeviceHandlers, devices)
 	assert.Equal(details.StorageHandlers, storages)
+
+	assert.Equal(details.SupportsSeccomp, haveSeccomp)
 }
 
 func TestGetGuestDetails(t *testing.T) {
@@ -673,7 +676,9 @@ func TestGetGuestDetails(t *testing.T) {
 	assert.NoError(err)
 
 	assert.Equal(resp.MemBlockSizeBytes, size)
-	testAgentDetails(assert, resp.AgentDetails)
+
+	seccompSupport := a.haveSeccomp()
+	testAgentDetails(assert, resp.AgentDetails, seccompSupport)
 }
 
 func TestGetAgentDetails(t *testing.T) {
@@ -687,5 +692,30 @@ func TestGetAgentDetails(t *testing.T) {
 
 	details := a.getAgentDetails(context.TODO())
 
-	testAgentDetails(assert, details)
+	seccompSupport := a.haveSeccomp()
+	testAgentDetails(assert, details, seccompSupport)
+}
+
+func TestHaveSeccomp(t *testing.T) {
+	assert := assert.New(t)
+
+	a := &agentGRPC{
+		sandbox: &sandbox{
+			containers: make(map[string]*container),
+		},
+	}
+
+	savedSeccompSupport := seccompSupport
+
+	defer func() {
+		seccompSupport = savedSeccompSupport
+	}()
+
+	for _, seccompSupport := range []string{"yes", "no"} {
+		if seccompSupport == "yes" {
+			assert.Equal(a.haveSeccomp(), seccomp.IsEnabled())
+		} else {
+			assert.Equal(a.haveSeccomp(), false)
+		}
+	}
 }