area/security/seccomphelp wantedkind/bugstatus/0-triage
仓库指标
- 星标
- (71,553 个星标)
- PR 合并指标
- (平均合并 43天 18小时) (30 天内合并 152 个 PR)
描述
Description
We hit this with runc earlier this year (https://github.com/opencontainers/runc/pull/4219), but I forgot to open an issue here. Basically, for some architectures Docker didn't include the native architecture in the set of architectures for the seccomp filter, which lead to the -ENOSYS stub to not work.
It seems like the runtime architecture should always be set by Docker, but we have fixed the issue in runc already.
https://bugzilla.suse.com/show_bug.cgi?id=1192051#c6 is some more debugging info.
Reproduce
- Without https://github.com/opencontainers/runc/pull/4219, run a Docker container on ppc64le.
- Try to call a syscall with a really large syscall number.
- Note that the
-ENOSYSstub doesn't work and you get-EPERM.
Expected behavior
Docker should set the architecture for seccomp so the -ENOSYS stub is always filled properly even on older runc versions.
docker version
n/a
docker info
n/a
Additional Info
No response