Docker seccomp works for alpine/busybox but not ubuntu

user_1734905 0
Viewed 260

I have this seccomp profile:

{
"defaultAction": "SCMP_ACT_ALLOW",
"architectures": [
    "SCMP_ARCH_X86_64",
    "SCMP_ARCH_X86",
    "SCMP_ARCH_X32"
],
"syscalls": [
    {
        "name": "chmod",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    },
    {
        "name": "chown",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    },
    {
        "name": "chown32",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    } }

When using this to filter syscalls on alpine or busybox containers, it works

docker run -it --security-opt seccomp=profile.json busybox /bin/sh
// chmod 777 /etc/hosts
// Error: operation not permitted

But it has no effect on ubuntu:18.04

docker run -it --security-opt seccomp=profile.json ubuntu:18.04 /bin/sh
// chmod 777 /etc/hosts
// Success

Docker version is 19.03.8

Has anyone encountered this problem?

docker ubuntu security
1 Answers

From the docker-lab, its seems you missing two more property to make it working with Linux properly

The default-no-chmod.json profile is a modification of the default.json profile> with the chmod(), fchmod(), and chmodat() syscalls removed from its whitelist.

enter image description here security-seccomp

{
"defaultAction": "SCMP_ACT_ALLOW",
"architectures": [
    "SCMP_ARCH_X86_64",
    "SCMP_ARCH_X86",
    "SCMP_ARCH_X32"
],
"syscalls": [
    {
        "name": "chmod",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    },
      {
        "name": "fchmod",
        "action": "SCMP_ACT_ERRNO",
        "args": [

        ]
      },
      {
        "name": "fchmodat",
        "action": "SCMP_ACT_ERRNO",
        "args": [

        ]
      },
    {
        "name": "chown",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    },
    {
        "name": "chown32",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    }] 
}

Now if you tried from ubuntu you will get expected result

docker run -it --security-opt seccomp=profile.json ubuntu:18.04 /bin/sh -c " chmod +x /etc/hosts"

chmod: changing permissions of '/etc/hosts': Operation not permitted

Also, same result for busybox

docker run -it --security-opt seccomp=profile.json busybox /bin/sh -c " chmod +x /etc/host"
chmod: /etc/host: No such file or directory
user_32888900
Related