snapd

Allow for seccomp blacklist rather than whitelisting

Bug #1615773 reported by Stéphane Graber
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
snapd
Triaged
Wishlist
Unassigned

Bug Description

LXD, LXC and quite probably Docker would benefit from the ability to define a syscall blacklist rather than a whitelist.

This would be to block known harmful syscalls but still allow EVERYTHING else, including syscalls which are not yet known to snappy or seccomp.

This would be done as a blacklist BPF filter and NOT as a whitelist of all other syscalls, which wouldn't work as it would only ever cover things that were known at the time seccomp or snappy were built and so would block anything newer.

Stéphane Graber (stgraber)
tags: added: lxd
Revision history for this message
Zygmunt Krynicki (zyga) wrote :

I think this is doable with a few tweaks to snap-confine and snapd. Please ack the design with jdstrand and niemayer and I can implement this.

tags: added: snapd-interface
Changed in snappy:
status: New → Triaged
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thank you for filing a bug, as mentioned in the PR, this isn't strictly required for lxd and docker and isn't needed at all for the transitional policy that we've decided should use @unrestricted. As such, marking as wishlist.

Changed in snappy:
importance: Undecided → Wishlist
status: Triaged → New
Revision history for this message
Stéphane Graber (stgraber) wrote :

Agreed, this is a wishlist as a way to add an extra safety net under lxc, lxd, docker at some point in the future, @unconfined will do fine for now.

Michael Vogt (mvo)
Changed in snappy:
status: New → Triaged
Michael Vogt (mvo)
affects: snappy → snapd
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.