Change seccomp blacklist to a whitelist

[jessfraz]

Running various tests on official images, but opening the discussion. ping @justincormack

[phemmer]

I was wondering why we weren't using a whitelist instead. The whitelist makes more sense to me for one main reason: default action is secure (http://stackoverflow.com/a/504424/486035).
With a blacklist, even if we blacklisted every possible syscall that could be abused, new kernels can come out which introduce new syscalls, and if docker's blacklist is old, it won't protect them.

👍

[jessfraz]

does this mean you will compile seccomp into your binary now 0:)

[cpuguy83]

SGTM

[thaJeztah]

Using a white list sounds like a better approach to me, so +1

Tentatively moving this to code review

[justincormack]

The clone rule needs fixing, will send patch. Ah sorry this was done I missed the commit.

I am slightly inclined to add back in the comments from the blacklisted syscalls as documentation of the ones not in the whitelist, not sure what anyone thinks.

[justincormack]

Ok I have tested this extensively: tested that individual syscalls are being correctly filtered, used it as my default docker install and built stuff (eg docker/docker, Linux kernel compile), double checked the syscall list for 32 bits, arm, powerpc. So LGTM.

For reference easiest way to check individual syscalls being filtered is:

docker run -it --cap-add ALL justincormack/ljsyscall -e "print(require('syscall').acct('/tmp/t'))"
nil Operation not permitted
docker run -it --cap-add ALL justincormack/ljsyscall -e "print(require('syscall').clone('newuts,newpid'))"
nil Operation not permitted
docker run -it --cap-add ALL --security-opt seccomp:unconfined justincormack/ljsyscall -e "print(require('syscall').acct('/tmp/t'))"
nil No such file or directory
docker run -it --cap-add ALL --security-opt seccomp:unconfined justincormack/ljsyscall -e "print(require('syscall').clone())"
11
0

[jessfraz]

Thanks I can add those as integration tests :) and I'm working on all new docs with the old comments as well

On Dec 30, 2015, 06:59 -0800, Justin Cormacknotifications@github.com, wrote:

Ok I have tested this extensively: tested that individual syscalls are being correctly filtered, used it as my default docker install and built stuff (eg docker/docker, Linux kernel compile), double checked the syscall list for 32 bits, arm, powerpc. So LGTM.

For reference easiest way to check individual syscalls being filtered is:

docker run -it --cap-add ALL justincormack/ljsyscall -e "print(require('syscall').acct('/tmp/t'))" nil Operation not permitted docker run -it --cap-add ALL justincormack/ljsyscall -e "print(require('syscall').clone('newuts,newpid'))" nil Operation not permitted docker run -it --cap-add ALL --security-opt seccomp:unconfined justincormack/ljsyscall -e "print(require('syscall').acct('/tmp/t'))" nil No such file or directory docker run -it --cap-add ALL --security-opt seccomp:unconfined justincormack/ljsyscall -e "print(require('syscall').clone())" 11 0

—
Reply to this email directly orview it on GitHub(#18979 (comment)).

[jessfraz]

opened additional tests here: #19002 and docs will come soon in another PR

[cpuguy83]

Looks like you have settimeofday in the whitelist, shouldn't that be blocked?

[jessfraz]

Good catch thanks

On Dec 30, 2015, 18:30 -0800, Brian Goffnotifications@github.com, wrote:

Looks like you havesettimeofdayin the whitelist, shouldn't that be blocked?

—
Reply to this email directly orview it on GitHub(#18979 (comment)).

[cpuguy83]

LGTM

[justincormack]

Looking good after more testing. There is one issue that running compatible architectures is currently blocked (eg 32 bit x86 on x86_64). There is an easier fix or a nicer one, will look at it tomorrow, but need not stop merging. Sent fix to @jfrazelle

[calavera]

sorry, wrong button 😄

[calavera]

That file looks quite long but whatever. LGTM

[jessfraz]

we could use go generate? I was thinking about that in the beginning

On Tue, Jan 5, 2016 at 9:22 AM, David Calavera notifications@github.com
wrote:

sorry, wrong button [image: 😄]

—
Reply to this email directly or view it on GitHub
#18979 (comment).

[justincormack]

Unfortunately Linux has too many syscalls, and it matches the libcontainer spec format, well the Go is a bit more readable. It is not ideal, but not sure there is much that can be done.

[jessfraz]

no i want it to be good :(

On Tue, Jan 5, 2016 at 9:23 AM, David Calavera notifications@github.com
wrote:

That file looks quite long but whatever. LGTM

—
Reply to this email directly or view it on GitHub
#18979 (comment).

[jessfraz]

FWIW it will be easier to see the diff once its merged ;)

[thaJeztah]

will merging make all red Janky's go green? 😇

[jessfraz]

i think it was becausse llvm repo was screwed up

[jessfraz]

green \o/