seccomp: Document AF_ALG and socketcall blocks from moby/moby#52494

vvoland · vvoland · commit 8165b8ba072b · 2026-05-01T09:40:58.000+02:00
Add `socket` and `socketcall` entries to the "Significant syscalls blocked by the default profile" table to reflect the seccomp profile changes that block AF_ALG sockets (CVE-2026-31431) and deny the socketcall multiplexer to prevent bypassing address family filters. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
diff --git a/content/manuals/engine/security/seccomp.md b/content/manuals/engine/security/seccomp.md
@@ -98,6 +98,8 @@ the reason each syscall is blocked rather than white-listed.
 | `setns`             | Deny associating a thread with a namespace. Also gated by `CAP_SYS_ADMIN`.                                                                                                                                                                     |
 | `settimeofday`      | Time/date is not namespaced. Also gated by `CAP_SYS_TIME`.                                                                                                                                                                                     |
 | `stime`             | Time/date is not namespaced. Also gated by `CAP_SYS_TIME`.                                                                                                                                                                                     |
+| `socket`            | Blocked for `AF_ALG` to prevent in-container privilege escalation via the kernel cryptographic API ([CVE-2026-31431](https://nvd.nist.gov/vuln/detail/CVE-2026-31431)). Also blocked for `AF_VSOCK`. See [moby/moby#52494](https://github.com/moby/moby/pull/52494). |
+| `socketcall`        | Denied to prevent bypassing socket address family filters on architectures with the legacy `socketcall` multiplexer (i386, s390, MIPS o32). See [moby/moby#52494](https://github.com/moby/moby/pull/52494).                                     |
 | `swapon`            | Deny start/stop swapping to file/device. Also gated by `CAP_SYS_ADMIN`.                                                                                                                                                                        |
 | `swapoff`           | Deny start/stop swapping to file/device. Also gated by `CAP_SYS_ADMIN`.                                                                                                                                                                        |
 | `sysfs`             | Obsolete syscall.                                                                                                                                                                                                                              |
