From ac47ad8ea4a281e81276e74d1a0bbaaa2a1f45f9 Mon Sep 17 00:00:00 2001 From: Justin Cormack Date: Wed, 24 Feb 2016 19:47:50 +0000 Subject: [PATCH] Add some uses of personality syscall to default seccomp filter We generally want to filter the personality(2) syscall, as it allows disabling ASLR, and turning on some poorly supported emulations that have been the target of CVEs. However the use cases for reading the current value, setting the default PER_LINUX personality, and setting PER_LINUX32 for 32 bit emulation are fine. See issue #20634 Signed-off-by: Justin Cormack (cherry picked from commit 39b799ac53e2ba397edc3063432d01478416dbc8) --- daemon/execdriver/native/seccomp_default.go | 33 +++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/daemon/execdriver/native/seccomp_default.go b/daemon/execdriver/native/seccomp_default.go index 572e3b0280..d57c4d26ac 100644 --- a/daemon/execdriver/native/seccomp_default.go +++ b/daemon/execdriver/native/seccomp_default.go @@ -869,6 +869,39 @@ var defaultSeccompProfile = &configs.Seccomp{ Action: configs.Allow, Args: []*configs.Arg{}, }, + { + Name: "personality", + Action: configs.Allow, + Args: []*configs.Arg{ + { + Index: 0, + Value: 0x0, + Op: configs.EqualTo, + }, + }, + }, + { + Name: "personality", + Action: configs.Allow, + Args: []*configs.Arg{ + { + Index: 0, + Value: 0x0008, + Op: configs.EqualTo, + }, + }, + }, + { + Name: "personality", + Action: configs.Allow, + Args: []*configs.Arg{ + { + Index: 0, + Value: 0xffffffff, + Op: configs.EqualTo, + }, + }, + }, { Name: "pipe", Action: configs.Allow,