Merge pull request #44564 from thaJeztah/20.10_backport_seccomp_block…

…_af_vsock [20.10 backport] seccomp: block socket calls to AF_VSOCK in default profile
moby · Dec 5, 2022 · cfb3ebe · cfb3ebe
2 parents 6dfa15b + a01576e
commit cfb3ebe
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 2 deletions.
diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json
@@ -348,7 +348,6 @@
 				"signalfd4",
 				"sigprocmask",
 				"sigreturn",
-				"socket",
 				"socketcall",
 				"socketpair",
 				"splice",
@@ -417,6 +416,22 @@
 			},
 			"excludes": {}
 		},
+		{
+			"names": [
+				"socket"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 40,
+					"op": "SCMP_CMP_NE"
+				}
+			],
+			"comment": "",
+			"includes": {},
+			"excludes": {}
+		},
 		{
 			"names": [
 				"personality"

diff --git a/profiles/seccomp/default_linux.go b/profiles/seccomp/default_linux.go
@@ -343,7 +343,6 @@ func DefaultProfile() *Seccomp {
 				"signalfd4",
 				"sigprocmask",
 				"sigreturn",
-				"socket",
 				"socketcall",
 				"socketpair",
 				"splice",
@@ -404,6 +403,17 @@ func DefaultProfile() *Seccomp {
 				MinKernel: &KernelVersion{4, 8},
 			},
 		},
+		{
+			Names:  []string{"socket"},
+			Action: specs.ActAllow,
+			Args: []*specs.LinuxSeccompArg{
+				{
+					Index: 0,
+					Value: unix.AF_VSOCK,
+					Op:    specs.OpNotEqual,
+				},
+			},
+		},
 		{
 			Names:  []string{"personality"},
 			Action: specs.ActAllow,