moby--moby

History

Justin Cormack dcf2632945 Revert "Block obsolete socket families in the default seccomp profile" This reverts commit `7e3a596a63`. Unfortunately, it was pointed out in https://github.com/moby/moby/pull/29076#commitcomment-21831387 that the `socketcall` syscall takes a pointer to a struct so it is not possible to use seccomp profiles to filter it. This means these cannot be blocked as you can use `socketcall` to call them regardless, as we currently allow 32 bit syscalls. Users who wish to block these should use a seccomp profile that blocks all 32 bit syscalls and then just block the non socketcall versions. Signed-off-by: Justin Cormack <justin.cormack@docker.com>	2017-05-09 14:26:00 +01:00
..
apparmor	Merge pull request #29314 from vdemeester/no-more-utils	2016-12-22 15:21:05 +01:00
seccomp	Revert "Block obsolete socket families in the default seccomp profile"	2017-05-09 14:26:00 +01:00

Justin Cormack dcf2632945 Revert "Block obsolete socket families in the default seccomp profile"

This reverts commit 7e3a596a63.

Unfortunately, it was pointed out in https://github.com/moby/moby/pull/29076#commitcomment-21831387
that the `socketcall` syscall takes a pointer to a struct so it is not possible to
use seccomp profiles to filter it. This means these cannot be blocked as you can
use `socketcall` to call them regardless, as we currently allow 32 bit syscalls.

Users who wish to block these should use a seccomp profile that blocks all
32 bit syscalls and then just block the non socketcall versions.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>

2017-05-09 14:26:00 +01:00

apparmor Merge pull request #29314 from vdemeester/no-more-utils 2016-12-22 15:21:05 +01:00

seccomp Revert "Block obsolete socket families in the default seccomp profile" 2017-05-09 14:26:00 +01:00