From 5b9a43d2e7aff575a398477a9b13b29a313f15a6 Mon Sep 17 00:00:00 2001 From: Kenta Tada Date: Fri, 31 May 2019 11:53:51 +0900 Subject: [PATCH] Fix seccomp contributed profile for clone syscall All clone flags for namespace should be denied. Also x/sys should be used instead of syscall. Signed-off-by: Kenta Tada --- contrib/seccomp/seccomp_default.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/contrib/seccomp/seccomp_default.go b/contrib/seccomp/seccomp_default.go index 011139d16..042052792 100644 --- a/contrib/seccomp/seccomp_default.go +++ b/contrib/seccomp/seccomp_default.go @@ -20,7 +20,8 @@ package seccomp import ( "runtime" - "syscall" + + "golang.org/x/sys/unix" "github.com/opencontainers/runtime-spec/specs-go" ) @@ -555,7 +556,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { Args: []specs.LinuxSeccompArg{ { Index: 1, - Value: syscall.CLONE_NEWNS | syscall.CLONE_NEWUTS | syscall.CLONE_NEWIPC | syscall.CLONE_NEWUSER | syscall.CLONE_NEWPID | syscall.CLONE_NEWNET, + Value: unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET | unix.CLONE_NEWCGROUP, ValueTwo: 0, Op: specs.OpMaskedEqual, }, @@ -570,7 +571,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { Args: []specs.LinuxSeccompArg{ { Index: 0, - Value: syscall.CLONE_NEWNS | syscall.CLONE_NEWUTS | syscall.CLONE_NEWIPC | syscall.CLONE_NEWUSER | syscall.CLONE_NEWPID | syscall.CLONE_NEWNET, + Value: unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET | unix.CLONE_NEWCGROUP, ValueTwo: 0, Op: specs.OpMaskedEqual, },