nspawn: Block AF_VSOCK with seccomp #40181
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AF_VSOCK is not namespaced, so let's be prudent and block access to it in nspawn until the kernel adds namespacing for AF_VSOCK sockets.
github-actions
bot
added
nspawn
please-review
Member
|
Could you add an option to opt-in (to re-enable it) please? Not being able to run VMs from inside nspawn would be a pain |
Member
|
hmm, I think this should become opt-out eventually. Hence, maybe turn this off by default, making it opt-in, but please set everything up so that we make it opt-out with systemd 262 or so? i.e. add a NEWS entry, and unless explicity turned off maybe write a brief log message that tells people that the default is going to change in v262 |
Member
|
and please reverse this, i.e. allow AF_INET, AF_INET6, AF_UNIX, disallow everything else. |
poettering
added
reviewed/needs-rework 🔨
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
AF_VSOCK is not namespaced, so let's be prudent
and block access to it in nspawn until the kernel
adds namespacing for AF_VSOCK sockets.