From 8df9af807ba0ae2c037e3a485ed2b89b046fb57d Mon Sep 17 00:00:00 2001 From: Justin Cormack Date: Fri, 11 Mar 2016 11:01:20 +0000 Subject: [PATCH] Allow restart_syscall in default seccomp profile Fixes #20818 This syscall was blocked as there was some concern that it could be used to bypass filtering of other syscall arguments. However none of the potential syscalls where this could be an issue (poll, nanosleep, clock_nanosleep, futex) are blocked in the default profile anyway. Signed-off-by: Justin Cormack Upstream-commit: 5abd881883883a132f96f8adb1b07b5545af452b Component: engine --- components/engine/docs/security/seccomp.md | 1 - components/engine/profiles/seccomp/default.json | 5 +++++ components/engine/profiles/seccomp/seccomp_default.go | 5 +++++ 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/components/engine/docs/security/seccomp.md b/components/engine/docs/security/seccomp.md index 196d93810d..e046aef9b0 100644 --- a/components/engine/docs/security/seccomp.md +++ b/components/engine/docs/security/seccomp.md @@ -114,7 +114,6 @@ the reason each syscall is blocked rather than white-listed. | `query_module` | Deny manipulation and functions on kernel modules. | | `quotactl` | Quota syscall which could let containers disable their own resource limits or process accounting. Also gated by `CAP_SYS_ADMIN`. | | `reboot` | Don't let containers reboot the host. Also gated by `CAP_SYS_BOOT`. | -| `restart_syscall` | Don't allow containers to restart a syscall. Possible seccomp bypass see: https://code.google.com/p/chromium/issues/detail?id=408827. | | `request_key` | Prevent containers from using the kernel keyring, which is not namespaced. | | `set_mempolicy` | Syscall that modifies kernel memory and NUMA settings. Already gated by `CAP_SYS_NICE`. | | `setns` | Deny associating a thread with a namespace. Also gated by `CAP_SYS_ADMIN`. | diff --git a/components/engine/profiles/seccomp/default.json b/components/engine/profiles/seccomp/default.json index 91f04d6ec4..bdebd7158b 100755 --- a/components/engine/profiles/seccomp/default.json +++ b/components/engine/profiles/seccomp/default.json @@ -999,6 +999,11 @@ "action": "SCMP_ACT_ALLOW", "args": [] }, + { + "name": "restart_syscall", + "action": "SCMP_ACT_ALLOW", + "args": [] + }, { "name": "rmdir", "action": "SCMP_ACT_ALLOW", diff --git a/components/engine/profiles/seccomp/seccomp_default.go b/components/engine/profiles/seccomp/seccomp_default.go index 181e9f5002..c5e6b736db 100644 --- a/components/engine/profiles/seccomp/seccomp_default.go +++ b/components/engine/profiles/seccomp/seccomp_default.go @@ -1028,6 +1028,11 @@ var DefaultProfile = &types.Seccomp{ Action: types.ActAllow, Args: []*types.Arg{}, }, + { + Name: "restart_syscall", + Action: types.ActAllow, + Args: []*types.Arg{}, + }, { Name: "rmdir", Action: types.ActAllow,