invalid seccomp syscall 'io_uring_enter': unknown. about crun HOT 6 CLOSED

Can crun ignore seccomp entries for unknown syscalls?

wouldn't that be a potential security issue if the syscall is blocked?

And if we skip syscalls that are allowed, then the container can fail despite a correct configuration.

Are you using a static build for crun? Perhaps we could build seccomp from git master there

from crun.

that is a libseccomp issue: seccomp/libseccomp#177

There is not a release yet that includes that syscalls, but the version from master works fine

For Fedora, we are working on backporting these patches to libseccomp

from crun.

Can crun ignore seccomp entries for unknown syscalls?

from crun.

I've opened a PR for using seccomp from master: #158

from crun.

I think it is better to ignore unknown syscalls, otherwise it requires exactly synchronised updates of seccomp policies and libseccomp versions which is a huge burden on users. Many distros will not update libseccomp for new syscalls for kernels they are not shipping, so then you cannot change your seccomp policy at all, which makes default seccomp policies very difficult to implement at all. Almost all changes are new syscalls for new kernels, so people are rarely relying on them and will have fallbacks.

from crun.

I think it is better to ignore unknown syscalls, otherwise it requires exactly synchronised updates of seccomp policies and libseccomp versions which is a huge burden on users. Many distros will not update libseccomp for new syscalls for kernels they are not shipping, so then you cannot change your seccomp policy at all, which makes default seccomp policies very difficult to implement at all. Almost all changes are new syscalls for new kernels, so people are rarely relying on them and will have fallbacks.

thanks for the explanation. That makes sense to me. I've added a patch to a PR I was already working on (just to avoid rebases) and I've switched the default to not fail when an unknown syscall is found in the seccomp profile: #211

from crun.