Commits on Dec 1, 2022

1. seccomp: block socket calls to AF_VSOCK in default profile …

   This syncs the seccomp-profile with the latest changes in containerd's
   profile, applying the same changes as containerd/containerd@17a9324
   
   Some background from the associated ticket:
   
   > We want to use vsock for guest-host communication on KubeVirt
   > (https://github.com/kubevirt/kubevirt). In KubeVirt we run VMs in pods.
   >
   > However since anyone can just connect from any pod to any VM with the
   > default seccomp settings, we cannot limit connection attempts to our
   > privileged node-agent.
   >
   > ### Describe the solution you'd like
   > We want to deny the `socket` syscall for the `AF_VSOCK` family by default.
   >
   > I see in [1] and [2] that AF_VSOCK was actually already blocked for some
   > time, but that got reverted since some architectures support the `socketcall`
   > syscall which can't be restricted properly. However we are mostly interested
   > in `arm64` and `amd64` where limiting `socket` would probably be enough.
   >
   > ### Additional context
   > I know that in theory we could use our own seccomp profiles, but we would want
   > to provide security for as many users as possible which use KubeVirt, and there
   > it would be very helpful if this protection could be added by being part of the
   > DefaultRuntime profile to easily ensure that it is active for all pods [3].
   >
   > Impact on existing workloads: It is unlikely that this will disturb any existing
   > workload, becuase VSOCK is almost exclusively used for host-guest commmunication.
   > However if someone would still use it: Privileged pods would still be able to
   > use `socket` for `AF_VSOCK`, custom seccomp policies could be applied too.
   > Further it was already blocked for quite some time and the blockade got lifted
   > due to reasons not related to AF_VSOCK.
   >
   > The PR in KubeVirt which adds VSOCK support for additional context: [4]
   >
   > [1]: moby#29076 (comment)
   > [2]: moby@dcf2632
   > [3]: https://kubernetes.io/docs/tutorials/security/seccomp/#enable-the-use-of-runtimedefault-as-the-default-seccomp-profile-for-all-workloads
   > [4]: kubevirt/kubevirt#8546
   
   Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
   (cherry picked from commit 57b2290)
   Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

   

   thaJeztah committed Dec 1, 2022
   Copy the full SHA

   a01576e View commit details

   Browse the repository at this point in the history