dcf2632945
This reverts commit 7e3a596a63.
Unfortunately, it was pointed out in https://github.com/moby/moby/pull/29076#commitcomment-21831387
that the `socketcall` syscall takes a pointer to a struct so it is not possible to
use seccomp profiles to filter it. This means these cannot be blocked as you can
use `socketcall` to call them regardless, as we currently allow 32 bit syscalls.
Users who wish to block these should use a seccomp profile that blocks all
32 bit syscalls and then just block the non socketcall versions.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
15 lines
565 B
Docker
15 lines
565 B
Docker
FROM buildpack-deps:jessie
|
|
|
|
COPY . /usr/src/
|
|
|
|
WORKDIR /usr/src/
|
|
|
|
RUN gcc -g -Wall -static userns.c -o /usr/bin/userns-test \
|
|
&& gcc -g -Wall -static ns.c -o /usr/bin/ns-test \
|
|
&& gcc -g -Wall -static acct.c -o /usr/bin/acct-test \
|
|
&& gcc -g -Wall -static setuid.c -o /usr/bin/setuid-test \
|
|
&& gcc -g -Wall -static setgid.c -o /usr/bin/setgid-test \
|
|
&& gcc -g -Wall -static socket.c -o /usr/bin/socket-test \
|
|
&& gcc -g -Wall -static raw.c -o /usr/bin/raw-test
|
|
|
|
RUN [ "$(uname -m)" = "x86_64" ] && gcc -s -m32 -nostdlib exit32.s -o /usr/bin/exit32-test || true
|