seccomp: Use an allow-list for socket domains - #39
Conversation
Replace the open-ended range checks with the Linux address families the default profile supports. AF_ALG and AF_VSOCK remain blocked, and unknown or future domains now receive the profile's default EPERM response. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
4fac163 to
f8d7350
Compare
|
Quick LLM review; in case it could indeed be an option;
|
|
Done. |
runc splits multiple comparisons on the same syscall argument into separate rules, so bounded ranges become unions and can allow blocked domains. Use one less-than rule for the consecutive domains below AF_ALG. The only additional value it matches is AF_UNSPEC, which is not a creatable domain. Keep higher domains as equality rules so AF_ALG, AF_VSOCK, and unknown or future domains remain blocked. This reduces the generated socket entries from 43 to seven. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
23ce641 to
65adc7e
Compare
|
@AkihiroSuda @djs55 PTAL |
|
@AkihiroSuda this one LGTY? |
| var allowedSocketDomains = []uint64{ | ||
| unix.AF_UNIX, | ||
| unix.AF_INET, | ||
| unix.AF_AX25, |
There was a problem hiding this comment.
FYI: AX25 was removed from the kernel
https://daily.hamweekly.com/2026/04/linux-kernel-removes-ax25-hamradio-subsystem-support/
| unix.AF_UNIX, | ||
| unix.AF_INET, | ||
| unix.AF_AX25, | ||
| unix.AF_IPX, |
There was a problem hiding this comment.
Who still uses IPX, AppleTalk, etc. ?
Those protocol drivers aren't likely maintained well, and may potentially have vulns.
There was a problem hiding this comment.
IPX was actually removed in 2018
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7a2e838d28cff6718a0bdf66164465402f8e40ed
There was a problem hiding this comment.
Yeah that would be the next step for me. The current state of this PR is to just switch to allow-list without behavior change yet.
| unix.AF_INET, | ||
| unix.AF_AX25, | ||
| unix.AF_IPX, | ||
| unix.AF_APPLETALK, |
There was a problem hiding this comment.
Removed from the kernel recently
https://www.phoronix.com/news/Linux-Drops-AppleTalk
4 participants
Replace the open-ended range checks with the Linux address families the default profile supports. AF_ALG and AF_VSOCK remain blocked, and unknown or future domains now receive the profile's default EPERM response.