Paweł Gronowski 0c23e946a7 seccomp: Block AF_ALG in default socket policy ...

AF_ALG (address family 38) exposes the Linux kernel crypto API to
userspace via socket(2). Containers have no legitimate need for this
interface under the default profile, and leaving it accessible widens
the kernel attack surface unnecessarily (see https://copy.fail/).

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

2026-05-11 13:19:11 +02:00

..

seccomp_default_test.go

Don't allow io_uring related syscalls in the RuntimeDefault seccomp profile.

2023-11-02 01:23:58 +00:00

seccomp_default_unsupported.go

chore: use go fix to cleanup old +build buildtag

2022-12-29 14:25:14 +08:00

seccomp_default.go

seccomp: Block AF_ALG in default socket policy

2026-05-11 13:19:11 +02:00

seccomp.go

Remove noinline in seccomp SpecOpts

2025-01-17 12:29:56 -07:00