Merge pull request #44712 from neersighted/20.10_revert_vsock_filter

[20.10] Revert "seccomp: block socket calls to AF_VSOCK in default profile"
moby · Dec 29, 2022 · ae6a931 · ae6a931
2 parents d46fe80 + dcf27af
commit ae6a931
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 27 deletions.
diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json
@@ -348,6 +348,7 @@
 				"signalfd4",
 				"sigprocmask",
 				"sigreturn",
+				"socket",
 				"socketcall",
 				"socketpair",
 				"splice",
@@ -416,22 +417,6 @@
 			},
 			"excludes": {}
 		},
-		{
-			"names": [
-				"socket"
-			],
-			"action": "SCMP_ACT_ALLOW",
-			"args": [
-				{
-					"index": 0,
-					"value": 40,
-					"op": "SCMP_CMP_NE"
-				}
-			],
-			"comment": "",
-			"includes": {},
-			"excludes": {}
-		},
 		{
 			"names": [
 				"personality"

diff --git a/profiles/seccomp/default_linux.go b/profiles/seccomp/default_linux.go
@@ -343,6 +343,7 @@ func DefaultProfile() *Seccomp {
 				"signalfd4",
 				"sigprocmask",
 				"sigreturn",
+				"socket",
 				"socketcall",
 				"socketpair",
 				"splice",
@@ -403,17 +404,6 @@ func DefaultProfile() *Seccomp {
 				MinKernel: &KernelVersion{4, 8},
 			},
 		},
-		{
-			Names:  []string{"socket"},
-			Action: specs.ActAllow,
-			Args: []*specs.LinuxSeccompArg{
-				{
-					Index: 0,
-					Value: unix.AF_VSOCK,
-					Op:    specs.OpNotEqual,
-				},
-			},
-		},
 		{
 			Names:  []string{"personality"},
 			Action: specs.ActAllow,