Commit Graph

4 Commits

Author SHA1 Message Date
Justin Cormack 7e3a596a63 Block obsolete socket families in the default seccomp profile
Linux supports many obsolete address families, which are usually available in
common distro kernels, but they are less likely to be properly audited and
may have security issues

This blocks all socket families in the socket (and socketcall where applicable) syscall
except
- AF_UNIX - Unix domain sockets
- AF_INET - IPv4
- AF_INET6 - IPv6
- AF_NETLINK - Netlink sockets for communicating with the ekrnel
- AF_PACKET - raw sockets, which are only allowed with CAP_NET_RAW

All other socket families are blocked, including Appletalk (native, not
over IP), IPX (remember that!), VSOCK and HVSOCK, which should not generally
be used in containers, etc.

Note that users can of course provide a profile per container or in the daemon
config if they have unusual use cases that require these.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-01-17 17:50:44 +00:00
Vincent Demeester c8016e669f
Use testEnv methods and remove most of the global variables
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2017-01-17 12:39:08 +01:00
Vincent Demeester 33968e6c7d
Remove pkg/integration and move it to testutil or integration-cli
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2016-12-30 18:26:34 +01:00
Vincent Demeester 433e2e8a1e
Introduce a environment package in integration-cli
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2016-12-29 11:00:50 +01:00
Renamed from integration-cli/fixtures_linux_daemon.go (Browse further)