Add process_vm read and write calls to default seccomp profile#7693
Add process_vm read and write calls to default seccomp profile#7693kzys merged 1 commit intocontainerd:mainfrom
Conversation
|
Hi @hoyosjs. Thanks for your PR. I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Please squash commits, then LGTM |
Follow up to 94faa70. The commit referenced allowed `ptrace` calls in the default seccomp profile following the usual tracing security checks in for Kernels newer than 4.8. Kernels prior to this version are susceptible to [CVE-2019-2054](GHSA-qgfr-27qf-f323). Moby's default had allowed for `ptrace` for kernels newer than 4.8 at the time the commit was created. The current [seccomp default](https://github.com/moby/moby/blob/master/profiles/seccomp/default_linux.go#L405-L417) has been updated to include `process_vm_read` and `process_vm_write`. Mirror that policy to complete the classic ptrace set of APIs. Signed-off-by: Juan Hoyos <[email protected]>
hoyosjs
force-pushed
the
juhoyosa/enable-ptrace-proc-vm-apis
branch
from
779ecee to
e224f77
Compare
|
@AkihiroSuda done, thanks |
5 participants
Follow up to 94faa70. The commit referenced allowed
ptracecalls in the default seccomp profile following the usual tracing security checks in for Kernels newer than 4.8. Kernels prior to this version are susceptible to CVE-2019-2054. Moby's default had allowed forptracefor kernels newer than 4.8 at the time the commit was created. The current seccomp default has been updated to includeprocess_vm_readandprocess_vm_write. Mirror that policy to complete the classic ptrace set of APIs.Signed-off-by: Juan Sebastian Hoyos Ayala [email protected]