From ed061a08de19ce99d223c60dfdbdf6054dd94290 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Thu, 30 Apr 2026 22:40:37 +0200 Subject: [PATCH] seccomp: Document socket rule scope and socketcall limitation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a comment explaining the purpose of the socket rules and noting that on 32-bit x86, socket() goes through socketcall(2) which is allowed unconditionally, so these arg filters only apply to the direct socket syscall. Signed-off-by: Paweł Gronowski --- contrib/seccomp/seccomp_default.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/contrib/seccomp/seccomp_default.go b/contrib/seccomp/seccomp_default.go index b75eea0b1f..b1e954c27a 100644 --- a/contrib/seccomp/seccomp_default.go +++ b/contrib/seccomp/seccomp_default.go @@ -426,6 +426,10 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { Action: specs.ActAllow, Args: []specs.LinuxSeccompArg{}, }, + // Allow socket(2) for all address families except AF_VSOCK. + // NOTE: on 32-bit x86, socket() goes through socketcall(2) which is + // allowed unconditionally above; these arg filters only apply to the + // direct socket syscall. { Names: []string{"socket"}, Action: specs.ActAllow,