kube: use native seccompProfile fields

pkg/domain/infra/abi/play.go

@@ -845,11 +845,6 @@ func (ic *ContainerEngine) playKubePod(ctx context.Context, podName string, podY
 		}
 	}
 
-	seccompPaths, err := kube.InitializeSeccompPaths(podYAML.ObjectMeta.Annotations, options.SeccompProfileRoot)
-	if err != nil {
-		return nil, nil, err
-	}
-
 	// Set the restart policy from the kube yaml at the pod level in podman
 	switch podYAML.Spec.RestartPolicy {
 	case v1.RestartPolicyAlways:
@@ -994,7 +989,7 @@ func (ic *ContainerEngine) playKubePod(ctx context.Context, podName string, podY
 			PodSecurityContext: podYAML.Spec.SecurityContext,
 			ReadOnly:           readOnly,
 			RestartPolicy:      define.RestartPolicyNo,
-			SeccompPaths:       seccompPaths,
+			SeccompProfileRoot: options.SeccompProfileRoot,
 			SecretsManager:     secretsManager,
 			UserNSIsHost:       p.Userns.IsHost(),
 			Volumes:            volumes,
@@ -1084,7 +1079,7 @@ func (ic *ContainerEngine) playKubePod(ctx context.Context, podName string, podY
 			PodSecurityContext: podYAML.Spec.SecurityContext,
 			RestartPolicy:      podSpec.PodSpecGen.RestartPolicy, // pass the restart policy to the container (https://github.com/containers/podman/issues/20903)
 			ReadOnly:           readOnly,
-			SeccompPaths:       seccompPaths,
+			SeccompProfileRoot: options.SeccompProfileRoot,
 			SecretsManager:     secretsManager,
 			UserNSIsHost:       p.Userns.IsHost(),
 			Volumes:            volumes,

pkg/specgen/generate/kube/kube.go

@@ -11,6 +11,7 @@ import (
 	"math"
 	"net"
 	"os"
+	"path/filepath"
 	"regexp"
 	"runtime"
 	"slices"
@@ -27,6 +28,7 @@ import (
 	"go.podman.io/common/pkg/secrets"
 	"go.podman.io/image/v5/manifest"
 	itypes "go.podman.io/image/v5/types"
+	"go.podman.io/podman/v6/libpod"
 	"go.podman.io/podman/v6/libpod/define"
 	ann "go.podman.io/podman/v6/pkg/annotations"
 	"go.podman.io/podman/v6/pkg/domain/entities"
@@ -164,8 +166,8 @@ type CtrSpecGenOptions struct {
 	PodInfraID string
 	// ConfigMaps the configuration maps for environment variables
 	ConfigMaps []v1.ConfigMap
-	// SeccompPaths for finding the seccomp profile path
-	SeccompPaths *KubeSeccompPaths
+	// SeccompProfileRoot is the base directory for Localhost seccomp profiles
+	SeccompProfileRoot string
 	// ReadOnly make all containers root file system readonly
 	ReadOnly itypes.OptionalBool
 	// RestartPolicy defines the restart policy of the container
@@ -287,7 +289,11 @@ func ToSpecGen(ctx context.Context, opts *CtrSpecGenOptions) (*specgen.SpecGener
 
 	s.InitContainerType = opts.InitContainerType
 
-	setupSecurityContext(s, opts.Container.SecurityContext, opts.PodSecurityContext)
+	err = setupSecurityContext(s, opts.Container.SecurityContext, opts.PodSecurityContext, opts.SeccompProfileRoot)
+	if err != nil {
+		return nil, fmt.Errorf("failed to configure securityContext: %w", err)
+	}
+
 	err = setupLivenessProbe(s, opts.Container, opts.RestartPolicy)
 	if err != nil {
 		return nil, fmt.Errorf("failed to configure livenessProbe: %w", err)
@@ -297,11 +303,6 @@ func ToSpecGen(ctx context.Context, opts *CtrSpecGenOptions) (*specgen.SpecGener
 		return nil, fmt.Errorf("failed to configure startupProbe: %w", err)
 	}
 
-	// Since we prefix the container name with pod name to work-around the uniqueness requirement,
-	// the seccomp profile should reference the actual container name from the YAML
-	// but apply to the containers with the prefixed name
-	s.SeccompProfilePath = opts.SeccompPaths.FindForContainer(opts.Container.Name)
-
 	setupContainerResources(s, opts.Container)
 
 	err = setupContainerDevices(s, opts.Container)
@@ -957,7 +958,7 @@ func setupContainerDevices(s *specgen.SpecGenerator, containerYAML v1.Container)
 	return nil
 }
 
-func setupSecurityContext(s *specgen.SpecGenerator, securityContext *v1.SecurityContext, podSecurityContext *v1.PodSecurityContext) {
+func setupSecurityContext(s *specgen.SpecGenerator, securityContext *v1.SecurityContext, podSecurityContext *v1.PodSecurityContext, profileRoot string) error {
 	if securityContext == nil {
 		securityContext = &v1.SecurityContext{}
 	}
@@ -1002,6 +1003,34 @@ func setupSecurityContext(s *specgen.SpecGenerator, securityContext *v1.Security
 			s.SelinuxOpts = append(s.SelinuxOpts, fmt.Sprintf("filetype:%s", seopt.FileType))
 		}
 	}
+
+	seccompProfile := securityContext.SeccompProfile
+	if seccompProfile == nil {
+		seccompProfile = podSecurityContext.SeccompProfile
+	}
+	if seccompProfile == nil {
+		seccompProfile = &v1.SeccompProfile{Type: v1.SeccompProfileTypeRuntimeDefault}
+	}
+	if seccompProfile != nil {
+		switch seccompProfile.Type {
+		case v1.SeccompProfileTypeRuntimeDefault:
+			seccompProfilePath, err := libpod.DefaultSeccompPath()
+			if err != nil {
+				return err
+			}
+			s.SeccompProfilePath = seccompProfilePath
+		case v1.SeccompProfileTypeUnconfined:
+			s.SeccompProfilePath = "unconfined"
+		case v1.SeccompProfileTypeLocalhost:
+			if seccompProfile.LocalhostProfile == nil || *seccompProfile.LocalhostProfile == "" {
+				return fmt.Errorf("seccomp profile type %q requires localhostProfile", seccompProfile.Type)
+			}
+			s.SeccompProfilePath = filepath.Join(profileRoot, *seccompProfile.LocalhostProfile)
+		default:
+			return fmt.Errorf("invalid seccomp profile type: %s", seccompProfile.Type)
+		}
+	}
+
 	if caps := securityContext.Capabilities; caps != nil {
 		for _, capability := range caps.Add {
 			s.CapAdd = append(s.CapAdd, string(capability))
@@ -1031,6 +1060,8 @@ func setupSecurityContext(s *specgen.SpecGenerator, securityContext *v1.Security
 	for _, group := range podSecurityContext.SupplementalGroups {
 		s.Groups = append(s.Groups, strconv.FormatInt(group, 10))
 	}
+
+	return nil
 }
 
 func quantityToInt64(quantity *resource.Quantity) int64 {

pkg/specgen/generate/kube/kube_test.go

@@ -3,12 +3,15 @@
 package kube
 
 import (
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"go.podman.io/podman/v6/libpod"
 	v1 "go.podman.io/podman/v6/pkg/k8s.io/api/core/v1"
 	"go.podman.io/podman/v6/pkg/k8s.io/apimachinery/pkg/api/resource"
 	"go.podman.io/podman/v6/pkg/k8s.io/apimachinery/pkg/util/intstr"
+	"go.podman.io/podman/v6/pkg/specgen"
 )
 
 func testPropagation(t *testing.T, propagation v1.MountPropagationMode, expected string) {
@@ -180,3 +183,69 @@ func TestQuantityToInt64(t *testing.T) {
 		})
 	}
 }
+
+func seccompProfile(profileType v1.SeccompProfileType, localhostProfile *string) *v1.SeccompProfile {
+	return &v1.SeccompProfile{Type: profileType, LocalhostProfile: localhostProfile}
+}
+
+func stringPtr(value string) *string {
+	return &value
+}
+
+func TestSetupSecurityContextSeccompProfile(t *testing.T) {
+	profileRoot := t.TempDir()
+	defaultPath, err := libpod.DefaultSeccompPath()
+	assert.NoError(t, err)
+
+	tests := []struct {
+		name     string
+		ctr      *v1.SecurityContext
+		pod      *v1.PodSecurityContext
+		expected string
+	}{
+		{
+			name: "container profile",
+			ctr: &v1.SecurityContext{
+				SeccompProfile: seccompProfile(v1.SeccompProfileTypeUnconfined, nil),
+			},
+			expected: "unconfined",
+		},
+		{
+			name: "pod profile",
+			pod: &v1.PodSecurityContext{
+				SeccompProfile: seccompProfile(v1.SeccompProfileTypeLocalhost, stringPtr("profiles/pod.json")),
+			},
+			expected: filepath.Join(profileRoot, "profiles/pod.json"),
+		},
+		{
+			name: "container overrides pod",
+			ctr: &v1.SecurityContext{
+				SeccompProfile: seccompProfile(v1.SeccompProfileTypeLocalhost, stringPtr("profiles/container.json")),
+			},
+			pod: &v1.PodSecurityContext{
+				SeccompProfile: seccompProfile(v1.SeccompProfileTypeUnconfined, nil),
+			},
+			expected: filepath.Join(profileRoot, "profiles/container.json"),
+		},
+		{
+			name:     "unset profile uses default",
+			expected: defaultPath,
+		},
+		{
+			name: "RuntimeDefault profile",
+			ctr: &v1.SecurityContext{
+				SeccompProfile: seccompProfile(v1.SeccompProfileTypeRuntimeDefault, nil),
+			},
+			expected: defaultPath,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := &specgen.SpecGenerator{}
+			err := setupSecurityContext(s, tt.ctr, tt.pod, profileRoot)
+			assert.NoError(t, err)
+			assert.Equal(t, tt.expected, s.SeccompProfilePath)
+		})
+	}
+}