mirror of
https://github.com/containerd/containerd.git
synced 2026-11-06 05:17:02 +00:00
Paweł Gronowski
5e1373098a
The default seccomp profile excludes AF_VSOCK for direct socket calls,
but 32-bit x86 binaries can reach it through socketcall because
seccomp cannot inspect the pointer argument.
Deny the family in AppArmor so the socket_create LSM hook closes that
path and prevents default-profile containers from reaching host or
guest VSOCK services.
This mirrors moby/profiles commit b7711bef4ad769a13fd40fe1ba710ad0f796fcfd
("apparmor: Deny AF_VSOCK sockets in default container profile").
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>