Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f0c491e

Browse files
author
Misty Stanley-Jones
committed
Document new rules for seccomp profile
1 parent fde5b48 commit f0c491e

File tree

1 file changed

+35
-80
lines changed

1 file changed

+35
-80
lines changed

‎engine/security/seccomp.md‎

Lines changed: 35 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -4,103 +4,57 @@ keywords: seccomp, security, docker, documentation
44
title: Seccomp security profiles for Docker
55
---
66

7-
Secure computing mode (Seccomp) is a Linux kernel feature. You can use it to
7+
Secure computing mode (`seccomp`) is a Linux kernel feature. You can use it to
88
restrict the actions available within the container. The `seccomp()` system
99
call operates on the seccomp state of the calling process. You can use this
1010
feature to restrict your application's access.
1111

12-
This feature is available only if Docker has been built with seccomp and the
12+
This feature is available only if Docker has been built with `seccomp` and the
1313
kernel is configured with `CONFIG_SECCOMP` enabled. To check if your kernel
14-
supports seccomp:
14+
supports `seccomp`:
1515

1616
```bash
1717
$ cat /boot/config-`uname -r` | grep CONFIG_SECCOMP=
1818
CONFIG_SECCOMP=y
1919
```
2020

21-
> **Note**: seccomp profiles require seccomp 2.2.1 and are only
21+
> **Note**: `seccomp` profiles require seccomp 2.2.1 and are only
2222
> available starting with Debian 9 "Stretch", Ubuntu 16.04 "Xenial",
23-
> Fedora 22, CentOS 7 and Oracle Linux 7. To use this feature on Ubuntu 14.04, Debian Wheezy, or
24-
> Debian Jessie, you must download the [latest static Docker Linux binary](../installation/binaries.md).
23+
> Fedora 22, CentOS 7 and Oracle Linux 7. To use this feature on Ubuntu 14.04,
24+
> Debian Wheezy, or Debian Jessie, you must download the
25+
> [latest static Docker Linux binary](../installation/binaries.md).
2526
> This feature is currently *not* available on other distributions.
2627
2728
## Passing a profile for a container
2829

29-
The default seccomp profile provides a sane default for running containers with
30-
seccomp and disables around 44 system calls out of 300+. It is moderately protective while providing wide application
31-
compatibility. The default Docker profile (found [here](https://github.com/docker/docker/blob/master/profiles/seccomp/default.json)) has a JSON layout in the following form:
32-
33-
```json
34-
{
35-
"defaultAction": "SCMP_ACT_ERRNO",
36-
"archMap": [
37-
{
38-
"architecture": "SCMP_ARCH_X86_64",
39-
"subArchitectures": [
40-
"SCMP_ARCH_X86",
41-
"SCMP_ARCH_X32"
42-
]
43-
},
44-
...
45-
],
46-
"syscalls": [
47-
{
48-
"names": [
49-
"accept",
50-
"accept4",
51-
"access",
52-
"alarm",
53-
"alarm",
54-
"bind",
55-
"brk",
56-
...
57-
"waitid",
58-
"waitpid",
59-
"write",
60-
"writev"
61-
],
62-
"action": "SCMP_ACT_ALLOW",
63-
"args": [],
64-
"comment": "",
65-
"includes": {},
66-
"excludes": {}
67-
},
68-
{
69-
"names": [
70-
"clone"
71-
],
72-
"action": "SCMP_ACT_ALLOW",
73-
"args": [
74-
{
75-
"index": 1,
76-
"value": 2080505856,
77-
"valueTwo": 0,
78-
"op": "SCMP_CMP_MASKED_EQ"
79-
}
80-
],
81-
"comment": "s390 parameter ordering for clone is different",
82-
"includes": {
83-
"arches": [
84-
"s390",
85-
"s390x"
86-
]
87-
},
88-
"excludes": {
89-
"caps": [
90-
"CAP_SYS_ADMIN"
91-
]
92-
}
93-
},
94-
...
95-
}
96-
```
30+
The default `seccomp` profile provides a sane default for running containers with
31+
seccomp and disables around 44 system calls out of 300+. It is moderately
32+
protective while providing wide application compatibility. The default Docker
33+
profile can be found
34+
[here](https://github.com/docker/docker/blob/master/profiles/seccomp/default.json)).
9735

98-
When you run a container, it uses the default profile unless you override
99-
it with the `security-opt` option. For example, the following explicitly
100-
specifies the default policy:
36+
In effect, the profile is a whitelist which denies access to system calls by
37+
default, then whitelists specific system calls. The profile works by defining a
38+
`defaultAction` of `SCMP_ACT_ERRNO` and overriding that action only for specific
39+
system calls. The effect of `SCMP_ACT_ERRNO` is to cause a `Permission Denied`
40+
error. Next, the profile defines a specific list of system calls which are fully
41+
allowed, because their `action` is overridden to be `SCMP_ACT_ALLOW`. Finally,
42+
some specific rules are for individual system calls such as `personality`,
43+
`socket`, `socketcall`, and others, to allow variants of those system calls with
44+
specific arguments.
10145

102-
```
103-
$ docker run --rm -it --security-opt seccomp=/path/to/seccomp/profile.json hello-world
46+
`seccomp` is instrumental for running Docker containers with least privilege. It
47+
is not recommended to change the default `seccomp` profile.
48+
49+
When you run a container, it uses the default profile unless you override it
50+
with the `--security-opt` option. For example, the following explicitly
51+
specifies a policy:
52+
53+
```bash
54+
$ docker run --rm \
55+
-it \
56+
--security-opt seccomp=/path/to/seccomp/profile.json \
57+
hello-world
10458
```
10559

10660
### Significant syscalls blocked by the default profile
@@ -150,7 +104,8 @@ the reason each syscall is blocked rather than white-listed.
150104
| `request_key` | Prevent containers from using the kernel keyring, which is not namespaced. |
151105
| `set_mempolicy` | Syscall that modifies kernel memory and NUMA settings. Already gated by `CAP_SYS_NICE`. |
152106
| `setns` | Deny associating a thread with a namespace. Also gated by `CAP_SYS_ADMIN`. |
153-
| `settimeofday` | Time/date is not namespaced. Also gated by `CAP_SYS_TIME`. |
107+
| `settimeofday` | Time/date is not namespaced. Also gated by `CAP_SYS_TIME`.
108+
| `socket`, `socketcall` | Used to send or receive packets and for other socket operations. All `socket` and `socketcall` calls are blocked except communication domains `AF_UNIX`, `AF_INET`, `AF_INET6`, `AF_NETLINK`, and `AF_PACKET`. |
154109
| `stime` | Time/date is not namespaced. Also gated by `CAP_SYS_TIME`. |
155110
| `swapon` | Deny start/stop swapping to file/device. Also gated by `CAP_SYS_ADMIN`. |
156111
| `swapoff` | Deny start/stop swapping to file/device. Also gated by `CAP_SYS_ADMIN`. |

0 commit comments

Comments
 (0)