6 ms·

I just contributed this [1] which does what you want for seccomp. Well, not by default, but profiling is now effective against this attack. Oh, an this [2] jus

I just contributed this [1] which does what you want for seccomp. Well, not by default, but profiling is now effective against this attack. Oh, an this [2] just happened [1] https://github.com/containers/oci-seccomp-bpf-hook/pull/209 https://github.com/containers/oci-seccomp-bpf-hook/pull/209 [2] https://github.com/moby/moby/pull/52501 https://github.com/moby/moby/pull/52501

Jasper_ 4mo ago
Blanket blocking socketcall() caused regressions for all 32-bit applications trying to make sockets. In theory, glibc disables socketcall when running on kernel version >= 4.3. In practice, Debian/Fedora/Ubuntu all set glibc's "expected kernel version" to 3.2, so socketcall() is still used on most 32-bit glibc binaries shipped. https://salsa.debian.org/glibc-team/glibc/-/blob/sid/debian/sysdeps/linux.mk#L4 https://salsa.debian.org/glibc-team/glibc/-/blob/sid/debian/... https://src.fedoraproject.org/rpms/glibc/blob/rawhide/f/glibc.spec#_436 https://src.fedoraproject.org/rpms/glibc/blob/rawhide/f/glib...
- fguerraz 4mo ago
  That’s… great. But who runs containerised 32 bit applications?