dilim/containerd
1
0
Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-08-08 17:11:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #13409 from k8s-infra-cherrypick-robot/cherry-pick-13327-to-release/2.3

Browse Source 
[release/2.3] seccomp: Block AF_ALG in default socket policy
This commit is contained in:
Maksym Pavlenko
2026-05-14 16:56:12 -07:00
committed by GitHub
parent 2315484b7e 4d80a31bf6
commit 85f22f7afa
1 changed files with 40 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
contrib/seccomp/seccomp_default.go
View File

@@ -426,6 +426,45 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp {
Action: specs.ActAllow,
Args: []specs.LinuxSeccompArg{},
},
// Allow socket(2) for all address families except AF_VSOCK and AF_ALG.
// NOTE: on socketcall(2)-based ABIs (for example 32-bit x86), socket()
// goes through socketcall(2), which is allowed unconditionally above.
// These arg filters only apply to the direct socket syscall.
//
// Do not use one rule with both "arg0 != AF_VSOCK" and "arg0 != AF_ALG".
// runc splits repeated argument-index conditions into separate
// libseccomp rules, so they behave like OR and allow both blocked
// domains.
//
// Do not combine explicit ERRNO rules with a broad socket ALLOW.
// libseccomp can make the ERRNO branch unreachable, collapse an
// unconditional ALLOW into a bare syscall allow, or silently reject
// repeated not-equal checks.
//
// These three single-condition ranges make AF_ALG and AF_VSOCK match
// none and fall through to the default errno action.
{
Names: []string{"socket"},
Action: specs.ActAllow,
Args: []specs.LinuxSeccompArg{
{
Index: 0,
Value: unix.AF_ALG,
Op: specs.OpLessThan,
},
},
},
{
Names: []string{"socket"},
Action: specs.ActAllow,
Args: []specs.LinuxSeccompArg{
{
Index: 0,
Value: unix.AF_ALG + 1,
Op: specs.OpEqualTo,
},
},
},
{
Names: []string{"socket"},
Action: specs.ActAllow,
@@ -433,7 +472,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp {
{
Index: 0,
Value: unix.AF_VSOCK,
Op: specs.OpNotEqual,
Op: specs.OpGreaterThan,
},
},
},