8000 seccomp: allow ptrace for 4.8+ kernels · moby/moby@1124543 · GitHub
[go: up one dir, main page]
Skip to content

Commit 1124543

Browse files
tonistiigitonistiigi
committed
seccomp: allow ptrace for 4.8+ kernels
4.8+ kernels have fixed the ptrace security issues so we can allow ptrace(2) on the default seccomp profile if we do the kernel version check. torvalds/linux@93e35ef Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
1 parent 35985ca commit 1124543

File tree

4 files changed

+53
-3
lines changed

4 files changed

+53
-3
lines changed

‎api/types/seccomp.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,9 @@ type Arg struct {
7777

7878
// Filter is used to conditionally apply Seccomp rules
7979
type Filter struct {
80-
Caps []string `json:"caps,omitempty"`
81-
Arches []string `json:"arches,omitempty"`
80+
Caps []string `json:"caps,omitempty"`
81+
Arches []string `json:"arches,omitempty"`
82+
MinKernel string `json:"minKernel,omitempty"`
8283
}
8384

8485
// Syscall is used to match a group of syscalls in Seccomp

‎profiles/seccomp/default.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -366,6 +366,18 @@
366366
"includes": {},
367367
"excludes": {}
368368
},
369+
{
370+
"names": [
371+
"ptrace"
372+
],
373+
"action": "SCMP_ACT_ALLOW",
374+
"args": null,
375+
"comment": "",
376+
"includes": {
377+
"minKernel": "4.8.0"
378+
},
379+
"excludes": {}
380+
},
369381
{
370382
"names": [
371383
"personality"

‎profiles/seccomp/seccomp.go‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@ import (
88
"fmt"
99

1010
"github.com/docker/docker/api/types"
11-
"github.com/opencontainers/runtime-spec/specs-go"
11+
"github.com/docker/docker/pkg/parsers/kernel"
12+
specs "github.com/opencontainers/runtime-spec/specs-go"
1213
libseccomp "github.com/seccomp/libseccomp-golang"
1314
)
1415

@@ -95,6 +96,21 @@ func setupSeccomp(config *types.Seccomp, rs *specs.Spec) (*specs.LinuxSeccomp, e
9596

9697
newConfig.DefaultAction = specs.LinuxSeccompAction(config.DefaultAction)
9798

99+
var currentKernelVersion *kernel.VersionInfo
100+
kernelGreaterEqualThan := func(v string) (bool, error) {
101+
version, err := kernel.ParseRelease(v)
102+
if err != nil {
103+
return false, err
104+
}
105+
if currentKernelVersion == nil {
106+
currentKernelVersion, err = kernel.GetKernelVersion()
107+
if err != nil {
108+
return false, err
109+
}
110+
}
111+
return kernel.CompareKernelVersion(*version, *currentKernelVersion) <= 0, nil
112+
}
113+
98114
Loop:
99115
// Loop through all syscall blocks and convert them to libcontainer format after filtering them
100116
for _, call := range config.Syscalls {
@@ -110,6 +126,13 @@ Loop:
110126
}
111127
}
112128
}
129+
if call.Excludes.MinKernel != "" {
130+
if ok, err := kernelGreaterEqualThan(call.Excludes.MinKernel); err != nil {
131+
return nil, err
132+
} else if ok {
133+
continue Loop
134+
}
135+
}
113136
if len(call.Includes.Arches) > 0 {
114137
if !inSlice(call.Includes.Arches, arch) {
115138
continue Loop
@@ -122,6 +145,13 @@ Loop:
122145
}
123146
}
124147
}
148+
if call.Includes.MinKernel != "" {
149+
if ok, err := kernelGreaterEqualThan(call.Includes.MinKernel); err != nil {
150+
return nil, err
151+
} else if !ok {
152+
continue Loop
153+
}
154+
}
125155

126156
if call.Name != "" && len(call.Names) != 0 {
127157
return nil, errors.New("'name' and 'names' were specified in the seccomp profile, use either 'name' or 'names'")

‎profiles/seccomp/seccomp_default.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,13 @@ func DefaultProfile() *types.Seccomp {
356356
Action: types.ActAllow,
357357
Args: []*types.Arg{},
358358
},
359+
{
360+
Names: []string{"ptrace"},
361+
Action: types.ActAllow,
362+
Includes: types.Filter{
363+
MinKernel: "4.8.0",
364+
},
365+
},
359366
{
360367
Names: []string{"personality"},
361368
Action: types.ActAllow,

0 commit comments

Comments
 (0)
0