Docker seccomp 适用于 alpine/busybox 但不适用于 ubuntu

Question

我有这个 seccomp 个人资料:

{
"defaultAction": "SCMP_ACT_ALLOW",
"architectures": [
    "SCMP_ARCH_X86_64",
    "SCMP_ARCH_X86",
    "SCMP_ARCH_X32"
],
"syscalls": [
    {
        "name": "chmod",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    },
    {
        "name": "chown",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    },
    {
        "name": "chown32",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    } }

当使用它来过滤 alpine 或 busybox 容器上的系统调用时，它可以工作

docker run -it --security-opt seccomp=profile.json busybox /bin/sh
// chmod 777 /etc/hosts
// Error: operation not permitted

但是对 ubuntu:18.04 没有影响

docker run -it --security-opt seccomp=profile.json ubuntu:18.04 /bin/sh
// chmod 777 /etc/hosts
// Success

Docker 版本是 19.03.8

有没有人遇到过这个问题？

Answer 1

来自 docker-lab ，看来您还缺少两个属性以使其正常与 Linux 一起工作

The default-no-chmod.json profile is a modification of the default.json profile> with the chmod(), fchmod(), and chmodat() syscalls removed from its whitelist.

security-seccomp

{
"defaultAction": "SCMP_ACT_ALLOW",
"architectures": [
    "SCMP_ARCH_X86_64",
    "SCMP_ARCH_X86",
    "SCMP_ARCH_X32"
],
"syscalls": [
    {
        "name": "chmod",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    },
      {
        "name": "fchmod",
        "action": "SCMP_ACT_ERRNO",
        "args": [

        ]
      },
      {
        "name": "fchmodat",
        "action": "SCMP_ACT_ERRNO",
        "args": [

        ]
      },
    {
        "name": "chown",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    },
    {
        "name": "chown32",
        "action": "SCMP_ACT_ERRNO",
        "args": []
    }] 
}

现在，如果您从 ubuntu 尝试过，您将得到预期的结果

docker run -it --security-opt seccomp=profile.json ubuntu:18.04 /bin/sh -c " chmod +x /etc/hosts"

chmod: changing permissions of '/etc/hosts': Operation not permitted

此外，busybox 的结果相同

docker run -it --security-opt seccomp=profile.json busybox /bin/sh -c " chmod +x /etc/host"
chmod: /etc/host: No such file or directory