diff --git a/pkg/seccomp/precompiledseccomp/precompiled_lib.tmpl.go b/pkg/seccomp/precompiledseccomp/precompiled_lib.tmpl.go index 9be4bff278..1984addb39 100644 --- a/pkg/seccomp/precompiledseccomp/precompiled_lib.tmpl.go +++ b/pkg/seccomp/precompiledseccomp/precompiled_lib.tmpl.go @@ -17,6 +17,8 @@ package precompiled import ( + "sort" + "gvisor.dev/gvisor/pkg/seccomp/precompiledseccomp" "gvisor.dev/gvisor/pkg/sync" ) @@ -39,6 +41,17 @@ func GetPrecompiled(programName string) (precompiledseccomp.Program, bool) { return program, ok } +// ListPrecompiled returns a list of all registered program names. +func ListPrecompiled() []string { + registerPrecompiledProgramsOnce.Do(registerPrograms) + programNames := make([]string, 0, len(precompiledPrograms)) + for name := range precompiledPrograms { + programNames = append(programNames, name) + } + sort.Strings(programNames) + return programNames +} + // registerPrograms registers available programs inside `precompiledPrograms`. func registerPrograms() { programs := make(map[string]precompiledseccomp.Program) diff --git a/runsc/boot/filter/filter.go b/runsc/boot/filter/filter.go index 4e500107c4..8c5cdd35c0 100644 --- a/runsc/boot/filter/filter.go +++ b/runsc/boot/filter/filter.go @@ -56,6 +56,13 @@ func Install(opt Options) error { seccompOpts.DefaultAction = linux.SECCOMP_RET_TRAP } else { log.Infof("No precompiled program found for config options %v, building seccomp program from scratch. This may slow down container startup.", key) + if log.IsLogging(log.Debug) { + precompiledKeys := ListPrecompiled() + log.Debugf("Precompiled seccomp-bpf program configuration option variants (%d):", len(precompiledKeys)) + for k := range precompiledKeys { + log.Debugf(" %v", k) + } + } } rules, denyRules := config.Rules(opt) return seccomp.Install(rules, denyRules, seccompOpts)