Browse code
Update seccomp.md
Corrected titles to use title case. Added link to default.json and some numerical detail. Changed example JSON to a portion of the actual default file, with the correct defaultAction.
Signed-off-by: Steven Iveson <steven.iveson@infinityworks.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Steven Iveson authored on 2016/03/01 01:03:31Showing 1 changed files
| ... | ... |
@@ -28,38 +28,30 @@ enabled. |
| 28 | 28 |
## Passing a profile for a container |
| 29 | 29 |
|
| 30 | 30 |
The default seccomp profile provides a sane default for running containers with |
| 31 |
-seccomp. It is moderately protective while providing wide application |
|
| 32 |
-compatibility. The default Docker profile has layout in the following form: |
|
| 31 |
+seccomp and disables around 44 system calls out of 300+. It is moderately protective while providing wide application |
|
| 32 |
+compatibility. The default Docker profile (found [here](https://github.com/docker/docker/blob/master/profiles/seccomp/default.json) has a JSON layout in the following form: |
|
| 33 | 33 |
|
| 34 | 34 |
``` |
| 35 | 35 |
{
|
| 36 |
- "defaultAction": "SCMP_ACT_ALLOW", |
|
| 37 |
- "syscalls": [ |
|
| 38 |
- {
|
|
| 39 |
- "name": "getcwd", |
|
| 40 |
- "action": "SCMP_ACT_ERRNO" |
|
| 41 |
- }, |
|
| 42 |
- {
|
|
| 43 |
- "name": "mount", |
|
| 44 |
- "action": "SCMP_ACT_ERRNO" |
|
| 45 |
- }, |
|
| 46 |
- {
|
|
| 47 |
- "name": "setns", |
|
| 48 |
- "action": "SCMP_ACT_ERRNO" |
|
| 49 |
- }, |
|
| 50 |
- {
|
|
| 51 |
- "name": "create_module", |
|
| 52 |
- "action": "SCMP_ACT_ERRNO" |
|
| 53 |
- }, |
|
| 54 |
- {
|
|
| 55 |
- "name": "chown", |
|
| 56 |
- "action": "SCMP_ACT_ERRNO" |
|
| 57 |
- }, |
|
| 58 |
- {
|
|
| 59 |
- "name": "chmod", |
|
| 60 |
- "action": "SCMP_ACT_ERRNO" |
|
| 61 |
- } |
|
| 62 |
- ] |
|
| 36 |
+ "defaultAction": "SCMP_ACT_ERRNO", |
|
| 37 |
+ "architectures": [ |
|
| 38 |
+ "SCMP_ARCH_X86_64", |
|
| 39 |
+ "SCMP_ARCH_X86", |
|
| 40 |
+ "SCMP_ARCH_X32" |
|
| 41 |
+ ], |
|
| 42 |
+ "syscalls": [ |
|
| 43 |
+ {
|
|
| 44 |
+ "name": "accept", |
|
| 45 |
+ "action": "SCMP_ACT_ALLOW", |
|
| 46 |
+ "args": [] |
|
| 47 |
+ }, |
|
| 48 |
+ {
|
|
| 49 |
+ "name": "accept4", |
|
| 50 |
+ "action": "SCMP_ACT_ALLOW", |
|
| 51 |
+ "args": [] |
|
| 52 |
+ } |
|
| 53 |
+ ... |
|
| 54 |
+ ] |
|
| 63 | 55 |
} |
| 64 | 56 |
``` |
| 65 | 57 |
|
| ... | ... |
@@ -71,7 +63,7 @@ specifies the default policy: |
| 71 | 71 |
$ docker run --rm -it --security-opt seccomp:/path/to/seccomp/profile.json hello-world |
| 72 | 72 |
``` |
| 73 | 73 |
|
| 74 |
-### Syscalls blocked by the default profile |
|
| 74 |
+### Significant syscalls blocked by the default profile |
|
| 75 | 75 |
|
| 76 | 76 |
Docker's default seccomp profile is a whitelist which specifies the calls that |
| 77 | 77 |
are allowed. The table below lists the significant (but not all) syscalls that |