Skip to content

Commit 7e3a596

Browse files
justincormackjustincormack
committed
Block obsolete socket families in the default seccomp profile
Linux supports many obsolete address families, which are usually available in common distro kernels, but they are less likely to be properly audited and may have security issues This blocks all socket families in the socket (and socketcall where applicable) syscall except - AF_UNIX - Unix domain sockets - AF_INET - IPv4 - AF_INET6 - IPv6 - AF_NETLINK - Netlink sockets for communicating with the ekrnel - AF_PACKET - raw sockets, which are only allowed with CAP_NET_RAW All other socket families are blocked, including Appletalk (native, not over IP), IPX (remember that!), VSOCK and HVSOCK, which should not generally be used in containers, etc. Note that users can of course provide a profile per container or in the daemon config if they have unusual use cases that require these. Signed-off-by: Justin Cormack <justin.cormack@docker.com>
1 parent f63d1a6 commit 7e3a596

File tree

6 files changed

+392
-7
lines changed

6 files changed

+392
-7
lines changed

‎contrib/syscall-test/Dockerfile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ RUN gcc -g -Wall -static userns.c -o /usr/bin/userns-test \
1010
&& gcc -g -Wall -static setuid.c -o /usr/bin/setuid-test \
1111
&& gcc -g -Wall -static setgid.c -o /usr/bin/setgid-test \
1212
&& gcc -g -Wall -static socket.c -o /usr/bin/socket-test \
13-
&& gcc -g -Wall -static raw.c -o /usr/bin/raw-test
13+
&& gcc -g -Wall -static raw.c -o /usr/bin/raw-test \
14+
&& gcc -g -Wall -static appletalk.c -o /usr/bin/appletalk-test
1415

1516
RUN [ "$(uname -m)" = "x86_64" ] && gcc -s -m32 -nostdlib exit32.s -o /usr/bin/exit32-test || true

‎contrib/syscall-test/appletalk.c‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#include <stdio.h>
2+
#include <sys/socket.h>
3+
4+
int main() {
5+
6+
if (socket(AF_APPLETALK, SOCK_DGRAM, 0) != -1) {
7+
fprintf(stderr, "Opening Appletalk socket worked, should be blocked\n");
8+
return 1;
9+
}
10+
11+
return 0;
12+
}

‎integration-cli/docker_cli_run_unix_test.go‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -978,7 +978,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyChmod(c *check.C) {
978978
}
979979

980980
// TestRunSeccompProfileDenyUnshareUserns checks that 'docker run debian:jessie unshare --map-root-user --user sh -c whoami' with a specific profile to
981-
// deny unhare of a userns exits with operation not permitted.
981+
// deny unshare of a userns exits with operation not permitted.
982982
func (s *DockerSuite) TestRunSeccompProfileDenyUnshareUserns(c *check.C) {
983983
testRequires(c, SameHostDaemon, seccompEnabled, NotArm, Apparmor)
984984
// from sched.h
@@ -1015,6 +1015,18 @@ func (s *DockerSuite) TestRunSeccompProfileDenyUnshareUserns(c *check.C) {
10151015
})
10161016
}
10171017

1018+
// TestRunSeccompProfileDenyUnusualSocketFamilies checks that rarely used socket families such as Appletalk are blocked by the default profile
1019+
func (s *DockerSuite) TestRunSeccompProfileDenyUnusualSocketFamilies(c *check.C) {
1020+
testRequires(c, SameHostDaemon, seccompEnabled)
1021+
ensureSyscallTest(c)
1022+
1023+
runCmd := exec.Command(dockerBinary, "run", "syscall-test", "appletalk-test")
1024+
_, _, err := runCommandWithOutput(runCmd)
1025+
if err != nil {
1026+
c.Fatal("expected opening appletalk socket family to fail")
1027+
}
1028+
}
1029+
10181030
// TestRunSeccompProfileDenyCloneUserns checks that 'docker run syscall-test'
10191031
// with a the default seccomp profile exits with operation not permitted.
10201032
func (s *DockerSuite) TestRunSeccompProfileDenyCloneUserns(c *check.C) {

‎integration-cli/fixtures_linux_daemon_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ func ensureSyscallTest(c *check.C) {
6262
gcc, err := exec.LookPath("gcc")
6363
c.Assert(err, checker.IsNil, check.Commentf("could not find gcc"))
6464

65-
tests := []string{"userns", "ns", "acct", "setuid", "setgid", "socket", "raw"}
65+
tests := []string{"userns", "ns", "acct", "setuid", "setgid", "socket", "raw", "appletalk"}
6666
for _, test := range tests {
6767
out, err := exec.Command(gcc, "-g", "-Wall", "-static", fmt.Sprintf("../contrib/syscall-test/%s.c", test), "-o", fmt.Sprintf("%s/%s-test", tmp, test)).CombinedOutput()
6868
c.Assert(err, checker.IsNil, check.Commentf(string(out)))

‎profiles/seccomp/default.json‎

Lines changed: 217 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -312,8 +312,6 @@
312312
"signalfd",
313313
"signalfd4",
314314
"sigreturn",
315-
"socket",
316-
"socketcall",
317315
"socketpair",
318316
"splice",
319317
"stat",
@@ -415,6 +413,223 @@
415413
"includes": {},
416414
"excludes": {}
417415
},
416+
{
417+
"names": [
418+
"socket"
419+
],
420+
"action": "SCMP_ACT_ALLOW",
421+
"args": [
422+
{
423+
"index": 0,
424+
"value": 1,
425+
"valueTwo": 0,
426+
"op": "SCMP_CMP_EQ"
427+
}
428+
],
429+
"comment": "",
430+
"includes": {},
431+
"excludes": {}
432+
},
433+
{
434+
"names": [
435+
"socket"
436+
],
437+
"action": "SCMP_ACT_ALLOW",
438+
"args": [
439+
{
440+
"index": 0,
441+
"value": 2,
442+
"valueTwo": 0,
443+
"op": "SCMP_CMP_EQ"
444+
}
445+
],
446+
"comment": "",
447+
"includes": {},
448+
"excludes": {}
449+
},
450+
{
451+
"names": [
452+
"socket"
453+
],
454+
"action": "SCMP_ACT_ALLOW",
455+
"args": [
456+
{
457+
"index": 0,
458+
"value": 10,
459+
"valueTwo": 0,
460+
"op": "SCMP_CMP_EQ"
461+
}
462+
],
463+
"comment": "",
464+
"includes": {},
465+
"excludes": {}
466+
},
467+
{
468+
"names": [
469+
"socket"
470+
],
471+
"action": "SCMP_ACT_ALLOW",
472+
"args": [
473+
{
474+
"index": 0,
475+
"value": 16,
476+
"valueTwo": 0,
477+
"op": "SCMP_CMP_EQ"
478+
}
479+
],
480+
"comment": "",
481+
"includes": {},
482+
"excludes": {}
483+
},
484+
{
485+
"names": [
486+
"socket"
487+
],
488+
"action": "SCMP_ACT_ALLOW",
489+
"args": [
490+
{
491+
"index": 0,
492+
"value": 17,
493+
"valueTwo": 0,
494+
"op": "SCMP_CMP_EQ"
495+
}
496+
],
497+
"comment": "",
498+
"includes": {},
499+
"excludes": {}
500+
},
501+
{
502+
"names": [
503+
"socketcall"
504+
],
505+
"action": "SCMP_ACT_ALLOW",
506+
"args": [
507+
{
508+
"index": 0,
509+
"value": 1,
510+
"valueTwo": 0,
511+
"op": "SCMP_CMP_GT"
512+
}
513+
],
514+
"comment": "",
515+
"includes": {},
516+
"excludes": {}
517+
},
518+
{
519+
"names": [
520+
"socketcall"
521+
],
522+
"action": "SCMP_ACT_ALLOW",
523+
"args": [
524+
{
525+
"index": 0,
526+
"value": 1,
527+
"valueTwo": 0,
528+
"op": "SCMP_CMP_EQ"
529+
},
530+
{
531+
"index": 1,
532+
"value": 1,
533+
"valueTwo": 0,
534+
"op": "SCMP_CMP_EQ"
535+
}
536+
],
537+
"comment": "",
538+
"includes": {},
539+
"excludes": {}
540+
},
541+
{
542+
"names": [
543+
"socketcall"
544+
],
545+
"action": "SCMP_ACT_ALLOW",
546+
"args": [
547+
{
548+
"index": 0,
549+
"value": 1,
550+
"valueTwo": 0,
551+
"op": "SCMP_CMP_EQ"
552+
},
553+
{
554+
"index": 1,
555+
"value": 2,
556+
"valueTwo": 0,
557+
"op": "SCMP_CMP_EQ"
558+
}
559+
],
560+
"comment": "",
561+
"includes": {},
562+
"excludes": {}
563+
},
564+
{
565+
"names": [
566+
"socketcall"
567+
],
568+
"action": "SCMP_ACT_ALLOW",
569+
"args": [
570+
{
571+
"index": 0,
572+
"value": 1,
573+
"valueTwo": 0,
574+
"op": "SCMP_CMP_EQ"
575+
},
576+
{
577+
"index": 1,
578+
"value": 10,
579+
"valueTwo": 0,
580+
"op": "SCMP_CMP_EQ"
581+
}
582+
],
583+
"comment": "",
584+
"includes": {},
585+
"excludes": {}
586+
},
587+
{
588+
"names": [
589+
"socketcall"
590+
],
591+
"action": "SCMP_ACT_ALLOW",
592+
"args": [
593+
{
594+
"index": 0,
595+
"value": 1,
596+
"valueTwo": 0,
597+
"op": "SCMP_CMP_EQ"
598+
},
599+
{
600+
"index": 1,
601+
"value": 16,
602+
"valueTwo": 0,
603+
"op": "SCMP_CMP_EQ"
604+
}
605+
],
606+
"comment": "",
607+
"includes": {},
608+
"excludes": {}
609+
},
610+
{
611+
"names": [
612+
"socketcall"
613+
],
614+
"action": "SCMP_ACT_ALLOW",
615+
"args": [
616+
{
617+
"index": 0,
618+
"value": 1,
619+
"valueTwo": 0,
620+
"op": "SCMP_CMP_EQ"
621+
},
622+
{
623+
"index": 1,
624+
"value": 17,
625+
"valueTwo": 0,
626+
"op": "SCMP_CMP_EQ"
627+
}
628+
],
629+
"comment": "",
630+
"includes": {},
631+
"excludes": {}
632+
},
418633
{
419634
"names": [
420635
"breakpoint",

0 commit comments

Comments
 (0)