diff options
| author | Justin Cormack <justin.cormack@docker.com> | 2017-05-09 14:21:19 +0100 |
|---|---|---|
| committer | Justin Cormack <justin.cormack@docker.com> | 2017-05-09 14:26:00 +0100 |
| commit | dcf2632945b87acedeea989a5aa36c084a20ae88 (patch) | |
| tree | 80066253924c2739fced98944896f8f192e62588 /integration-cli/fixtures_linux_daemon_test.go | |
| parent | 85a7f4bbc7e3817f7ab0aaff270aad697e86068c (diff) | |
| download | docker-dcf2632945b87acedeea989a5aa36c084a20ae88.tar.gz | |
Revert "Block obsolete socket families in the default seccomp profile"
This reverts commit 7e3a596a63fd8d0ab958132901b6ded81f8b44c0.
Unfortunately, it was pointed out in https://github.com/moby/moby/pull/29076#commitcomment-21831387
that the `socketcall` syscall takes a pointer to a struct so it is not possible to
use seccomp profiles to filter it. This means these cannot be blocked as you can
use `socketcall` to call them regardless, as we currently allow 32 bit syscalls.
Users who wish to block these should use a seccomp profile that blocks all
32 bit syscalls and then just block the non socketcall versions.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Diffstat (limited to 'integration-cli/fixtures_linux_daemon_test.go')
| -rw-r--r-- | integration-cli/fixtures_linux_daemon_test.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/integration-cli/fixtures_linux_daemon_test.go b/integration-cli/fixtures_linux_daemon_test.go index 4968514701..895f976a18 100644 --- a/integration-cli/fixtures_linux_daemon_test.go +++ b/integration-cli/fixtures_linux_daemon_test.go @@ -60,7 +60,7 @@ func ensureSyscallTest(c *check.C) { gcc, err := exec.LookPath("gcc") c.Assert(err, checker.IsNil, check.Commentf("could not find gcc")) - tests := []string{"userns", "ns", "acct", "setuid", "setgid", "socket", "raw", "appletalk"} + tests := []string{"userns", "ns", "acct", "setuid", "setgid", "socket", "raw"} for _, test := range tests { out, err := exec.Command(gcc, "-g", "-Wall", "-static", fmt.Sprintf("../contrib/syscall-test/%s.c", test), "-o", fmt.Sprintf("%s/%s-test", tmp, test)).CombinedOutput() c.Assert(err, checker.IsNil, check.Commentf(string(out))) |