seccomp: block AF_ALG sockets by default

vvoland · vvoland · commit 5eaf93c13718 · 2026-04-30T21:00:25.000+02:00
Add another NE case

Signed-off-by: Paweł Gronowski &lt;pawel.gronowski@docker.com&gt;
diff --git a/seccomp/default.json b/seccomp/default.json
@@ -446,6 +446,11 @@
 					"index": 0,
 					"value": 40,
 					"op": "SCMP_CMP_NE"
+				},
+				{
+					"index": 0,
+					"value": 38,
+					"op": "SCMP_CMP_NE"
 				}
 			]
 		},
diff --git a/seccomp/default_linux.go b/seccomp/default_linux.go
@@ -444,6 +444,11 @@ func DefaultProfile() *Seccomp {
 						Value: unix.AF_VSOCK,
 						Op:    specs.OpNotEqual,
 					},
+					{
+						Index: 0,
+						Value: unix.AF_ALG,
+						Op:    specs.OpNotEqual,
+					},
 				},
 			},
 		},
