From e24f320dd1a05f03c4f6ad6ee028b12deae6c443 Mon Sep 17 00:00:00 2001 From: Justin Cormack Date: Mon, 23 May 2016 15:19:19 -0700 Subject: [PATCH] Enable seccomp on ppc64le In order to do this, allow the socketcall syscall in the default seccomp profile. This is a multiplexing syscall for the socket operations, which is becoming obsolete gradually, but it is used in some architectures. libseccomp has special handling for it for x86 where it is common, so we did not need it in the profile, but does not have any handling for ppc64le. It turns out that the Debian images we use for tests do use the socketcall, while the newer images such as Ubuntu 16.04 do not. Enabling this does no harm as we allow all the socket operations anyway, and we allow the similar ipc call for similar reasons already. Signed-off-by: Justin Cormack (cherry picked from commit a83cedddc6d3e0fe1df352ec54245090df641ab8) --- Dockerfile.ppc64le | 2 +- profiles/seccomp/default.json | 5 +++++ profiles/seccomp/seccomp_default.go | 5 +++++ 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/Dockerfile.ppc64le b/Dockerfile.ppc64le index a78684cc45..9adefcfdf0 100644 --- a/Dockerfile.ppc64le +++ b/Dockerfile.ppc64le @@ -153,7 +153,7 @@ RUN useradd --create-home --gid docker unprivilegeduser VOLUME /var/lib/docker WORKDIR /go/src/github.com/docker/docker -ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux +ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux # Let us use a .bashrc file RUN ln -sfv $PWD/.bashrc ~/.bashrc diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json index 28d564c1e0..5c70f88ad7 100755 --- a/profiles/seccomp/default.json +++ b/profiles/seccomp/default.json @@ -1379,6 +1379,11 @@ "action": "SCMP_ACT_ALLOW", "args": [] }, + { + "name": "socketcall", + "action": "SCMP_ACT_ALLOW", + "args": [] + }, { "name": "socketpair", "action": "SCMP_ACT_ALLOW", diff --git a/profiles/seccomp/seccomp_default.go b/profiles/seccomp/seccomp_default.go index be93d780a5..4fad7a6c1e 100644 --- a/profiles/seccomp/seccomp_default.go +++ b/profiles/seccomp/seccomp_default.go @@ -1408,6 +1408,11 @@ var DefaultProfile = &types.Seccomp{ Action: types.ActAllow, Args: []*types.Arg{}, }, + { + Name: "socketcall", + Action: types.ActAllow, + Args: []*types.Arg{}, + }, { Name: "socketpair", Action: types.ActAllow,