dilim/containerd
1
0
Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-08-09 09:33:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

seccomp: Block AF_ALG in default socket policy

Browse Source 
AF_ALG (address family 38) exposes the Linux kernel crypto API to
userspace via socket(2). Containers have no legitimate need for this
interface under the default profile, and leaving it accessible widens
the kernel attack surface unnecessarily (see https://copy.fail/).

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This commit is contained in:
Paweł Gronowski
2026-04-30 21:31:01 +02:00
committed by k8s-infra-cherrypick-robot
parent 2ed0d97b6e
commit 4d80a31bf6
1 changed files with 40 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
contrib/seccomp/seccomp_default.go
View File

@@ -426,10 +426,45 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp {
Action: specs.ActAllow,
Args: []specs.LinuxSeccompArg{},
},
// Allow socket(2) for all address families except AF_VSOCK.
// NOTE: on 32-bit x86, socket() goes through socketcall(2) which is
// allowed unconditionally above; these arg filters only apply to the
// direct socket syscall.
// Allow socket(2) for all address families except AF_VSOCK and AF_ALG.
// NOTE: on socketcall(2)-based ABIs (for example 32-bit x86), socket()
// goes through socketcall(2), which is allowed unconditionally above.
// These arg filters only apply to the direct socket syscall.
//
// Do not use one rule with both "arg0 != AF_VSOCK" and "arg0 != AF_ALG".
// runc splits repeated argument-index conditions into separate
// libseccomp rules, so they behave like OR and allow both blocked
// domains.
//
// Do not combine explicit ERRNO rules with a broad socket ALLOW.
// libseccomp can make the ERRNO branch unreachable, collapse an
// unconditional ALLOW into a bare syscall allow, or silently reject
// repeated not-equal checks.
//
// These three single-condition ranges make AF_ALG and AF_VSOCK match
// none and fall through to the default errno action.
{
Names: []string{"socket"},
Action: specs.ActAllow,
Args: []specs.LinuxSeccompArg{
{
Index: 0,
Value: unix.AF_ALG,
Op: specs.OpLessThan,
},
},
},
{
Names: []string{"socket"},
Action: specs.ActAllow,
Args: []specs.LinuxSeccompArg{
{
Index: 0,
Value: unix.AF_ALG + 1,
Op: specs.OpEqualTo,
},
},
},
{
Names: []string{"socket"},
Action: specs.ActAllow,
@@ -437,7 +472,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp {
{
Index: 0,
Value: unix.AF_VSOCK,
Op: specs.OpNotEqual,
Op: specs.OpGreaterThan,
},
},
},