Merge pull request #627 from giuseppe/fix-seccomp-profile

seccomp: tweak default profile (followup for #573)
containers · Jun 18, 2021 · 5a0821b · 5a0821b
2 parents c034cf4 + 689e5b0
commit 5a0821b
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 76 deletions.
diff --git a/pkg/seccomp/default_linux.go b/pkg/seccomp/default_linux.go
@@ -51,14 +51,9 @@ func DefaultProfile() *Seccomp {
 		{
 			Names: []string{
 				"bdflush",
-				"clone3",
 				"io_pgetevents",
-				"io_uring_enter",
-				"io_uring_register",
-				"io_uring_setup",
 				"kexec_file_load",
 				"kexec_load",
-				"membarrier",
 				"migrate_pages",
 				"move_pages",
 				"nfsservctl",
@@ -71,10 +66,6 @@ func DefaultProfile() *Seccomp {
 				"pciconfig_iobase",
 				"pciconfig_read",
 				"pciconfig_write",
-				"pkey_alloc",
-				"pkey_free",
-				"pkey_mprotect",
-				"rseq",
 				"sgetmask",
 				"ssetmask",
 				"swapcontext",
@@ -118,6 +109,7 @@ func DefaultProfile() *Seccomp {
 				"clock_nanosleep",
 				"clock_nanosleep_time64",
 				"clone",
+				"clone3",
 				"close",
 				"close_range",
 				"connect",
@@ -191,6 +183,7 @@ func DefaultProfile() *Seccomp {
 				"getgroups",
 				"getgroups32",
 				"getitimer",
+				"get_mempolicy",
 				"getpeername",
 				"getpgid",
 				"getpgrp",
@@ -241,6 +234,7 @@ func DefaultProfile() *Seccomp {
 				"lstat",
 				"lstat64",
 				"madvise",
+				"mbind",
 				"memfd_create",
 				"mincore",
 				"mkdir",
@@ -286,6 +280,9 @@ func DefaultProfile() *Seccomp {
 				"pipe",
 				"pipe2",
 				"pivot_root",
+				"pkey_alloc",
+				"pkey_free",
+				"pkey_mprotect",
 				"poll",
 				"ppoll",
 				"ppoll_time64",
@@ -318,6 +315,7 @@ func DefaultProfile() *Seccomp {
 				"renameat2",
 				"restart_syscall",
 				"rmdir",
+				"rseq",
 				"rt_sigaction",
 				"rt_sigpending",
 				"rt_sigprocmask",
@@ -354,6 +352,7 @@ func DefaultProfile() *Seccomp {
 				"sendmsg",
 				"sendto",
 				"setns",
+				"set_mempolicy",
 				"set_robust_list",
 				"set_thread_area",
 				"set_tid_address",
@@ -663,31 +662,6 @@ func DefaultProfile() *Seccomp {
 				Caps: []string{"CAP_SYS_MODULE"},
 			},
 		},
-		{
-			Names: []string{
-				"get_mempolicy",
-				"mbind",
-				"set_mempolicy",
-			},
-			Action: ActAllow,
-			Args:   []*Arg{},
-			Includes: Filter{
-				Caps: []string{"CAP_SYS_NICE"},
-			},
-		},
-		{
-			Names: []string{
-				"get_mempolicy",
-				"mbind",
-				"set_mempolicy",
-			},
-			Action:   ActErrno,
-			ErrnoRet: &eperm,
-			Args:     []*Arg{},
-			Excludes: Filter{
-				Caps: []string{"CAP_SYS_NICE"},
-			},
-		},
 		{
 			Names: []string{
 				"acct",

diff --git a/pkg/seccomp/seccomp.json b/pkg/seccomp/seccomp.json
@@ -54,14 +54,9 @@
 		{
 			"names": [
 				"bdflush",
-				"clone3",
 				"io_pgetevents",
-				"io_uring_enter",
-				"io_uring_register",
-				"io_uring_setup",
 				"kexec_file_load",
 				"kexec_load",
-				"membarrier",
 				"migrate_pages",
 				"move_pages",
 				"nfsservctl",
@@ -74,10 +69,6 @@
 				"pciconfig_iobase",
 				"pciconfig_read",
 				"pciconfig_write",
-				"pkey_alloc",
-				"pkey_free",
-				"pkey_mprotect",
-				"rseq",
 				"sgetmask",
 				"ssetmask",
 				"swapcontext",
@@ -124,6 +115,7 @@
 				"clock_nanosleep",
 				"clock_nanosleep_time64",
 				"clone",
+				"clone3",
 				"close",
 				"close_range",
 				"connect",
@@ -197,6 +189,7 @@
 				"getgroups",
 				"getgroups32",
 				"getitimer",
+				"get_mempolicy",
 				"getpeername",
 				"getpgid",
 				"getpgrp",
@@ -247,6 +240,7 @@
 				"lstat",
 				"lstat64",
 				"madvise",
+				"mbind",
 				"memfd_create",
 				"mincore",
 				"mkdir",
@@ -292,6 +286,9 @@
 				"pipe",
 				"pipe2",
 				"pivot_root",
+				"pkey_alloc",
+				"pkey_free",
+				"pkey_mprotect",
 				"poll",
 				"ppoll",
 				"ppoll_time64",
@@ -324,6 +321,7 @@
 				"renameat2",
 				"restart_syscall",
 				"rmdir",
+				"rseq",
 				"rt_sigaction",
 				"rt_sigpending",
 				"rt_sigprocmask",
@@ -360,6 +358,7 @@
 				"sendmsg",
 				"sendto",
 				"setns",
+				"set_mempolicy",
 				"set_robust_list",
 				"set_thread_area",
 				"set_tid_address",
@@ -759,39 +758,6 @@
 			},
 			"errnoRet": 1
 		},
-		{
-			"names": [
-				"get_mempolicy",
-				"mbind",
-				"set_mempolicy"
-			],
-			"action": "SCMP_ACT_ALLOW",
-			"args": [],
-			"comment": "",
-			"includes": {
-				"caps": [
-					"CAP_SYS_NICE"
-				]
-			},
-			"excludes": {}
-		},
-		{
-			"names": [
-				"get_mempolicy",
-				"mbind",
-				"set_mempolicy"
-			],
-			"action": "SCMP_ACT_ERRNO",
-			"args": [],
-			"comment": "",
-			"includes": {},
-			"excludes": {
-				"caps": [
-					"CAP_SYS_NICE"
-				]
-			},
-			"errnoRet": 1
-		},
 		{
 			"names": [
 				"acct"