Comments (6)
Can crun ignore seccomp entries for unknown syscalls?
wouldn't that be a potential security issue if the syscall is blocked?
And if we skip syscalls that are allowed, then the container can fail despite a correct configuration.
Are you using a static build for crun? Perhaps we could build seccomp from git master there
from crun.
that is a libseccomp issue: seccomp/libseccomp#177
There is not a release yet that includes that syscalls, but the version from master works fine
For Fedora, we are working on backporting these patches to libseccomp
from crun.
Can crun ignore seccomp entries for unknown syscalls?
from crun.
I've opened a PR for using seccomp from master: #158
from crun.
I think it is better to ignore unknown syscalls, otherwise it requires exactly synchronised updates of seccomp policies and libseccomp versions which is a huge burden on users. Many distros will not update libseccomp for new syscalls for kernels they are not shipping, so then you cannot change your seccomp policy at all, which makes default seccomp policies very difficult to implement at all. Almost all changes are new syscalls for new kernels, so people are rarely relying on them and will have fallbacks.
from crun.
I think it is better to ignore unknown syscalls, otherwise it requires exactly synchronised updates of seccomp policies and libseccomp versions which is a huge burden on users. Many distros will not update libseccomp for new syscalls for kernels they are not shipping, so then you cannot change your seccomp policy at all, which makes default seccomp policies very difficult to implement at all. Almost all changes are new syscalls for new kernels, so people are rarely relying on them and will have fallbacks.
thanks for the explanation. That makes sense to me. I've added a patch to a PR I was already working on (just to avoid rebases) and I've switched the default to not fail when an unknown syscall is found in the seccomp profile: #211
from crun.
Related Issues (20)
- Read-only file volumes fail on fedora 39 with docker HOT 5
- How to verify downloaded binaries? HOT 2
- Release v1.14.4 HOT 2
- unrecognized option '--keep' when using crun for building docker images HOT 2
- Example Config HOT 1
- Crun not starting in amd64/x86_64 docker container on Apple Silicon HOT 3
- crun 1.14.4: `Error: OCI runtime error: crun: Error relocating /usr/bin/crun: statx: symbol not found` HOT 3
- BPF create error when use debian bullseye kernel >= 5.10.0-26-amd64 HOT 1
- Discrepancy between crun and runc when disallowing access by default to devices with cgroups v1 HOT 5
- Does not ignore SIGWINCH if no terminal is allocated
- container create failed: sd-bus call: Cannot set property CPUQuotaPeriodUSec, or unknown propert HOT 8
- Compilation error with clang++ 17 HOT 3
- Missing libsystemd headers on Alpine Linux v3.19 HOT 2
- Version 1.14.5 HOT 1
- [packit] Propose downstream failed for release 1.15 HOT 2
- Container creation fails with read-only bind mount HOT 3
- what is the purpose and future of crun-wasm - asking for (a friend) Debian packaging :) ? HOT 5
- Different CRUN/RUNC cgroup hierarchy HOT 6
- weird seccomp caching bug, causes bud-runtime-flag test to flake HOT 4
- The flag `O_PATH` could be added in more places HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from crun.