Paweł Gronowski 03d46bb397 seccomp: Use an allow-list for socket domains ...

The default profile allowed socket(2) through open-ended range checks
around AF_ALG and AF_VSOCK. Any address family added to Linux later was
allowed automatically.

List the Linux address families the default profile supports and build
the socket rules from that list.

AF_ALG and AF_VSOCK stay blocked, and unknown or future domains now get
the default EPERM response.

A single rule cannot bound both ends of a range, because runc treats
repeated comparisons on one argument as OR.

The consecutive run starting at AF_UNIX therefore becomes one less-than
rule, which is safe because AF_UNSPEC cannot be created. Every other
domain gets its own equality rule.

This matches the same change in Moby's default seccomp profile.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

2026-09-28 17:31:21 +02:00

..

seccomp_default_test.go

seccomp: Use an allow-list for socket domains

2026-09-28 17:31:21 +02:00

seccomp_default_unsupported.go

chore: use go fix to cleanup old +build buildtag

2022-12-29 14:25:14 +08:00

seccomp_default.go

seccomp: Use an allow-list for socket domains

2026-09-28 17:31:21 +02:00

seccomp.go

Remove noinline in seccomp SpecOpts

2025-01-17 12:29:56 -07:00