Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Switch seccomp network filter from blacklist to whitelist #33

Closed
cd-work opened this issue Aug 28, 2023 · 0 comments · Fixed by #37
Closed

Switch seccomp network filter from blacklist to whitelist #33

cd-work opened this issue Aug 28, 2023 · 0 comments · Fixed by #37
Assignees
@cd-work

Comments

@cd-work
Copy link
Collaborator

cd-work commented Aug 28, 2023

Currently the seccomp network filter will allow all system calls which are not handled. This is problematic since future syscall additions can add new ways to do networking which would automatically be allowed.

To ensure that the seccomp filter doesn't get surprised by new kernel syscalls, a whitelist-based approach should be used instead which denies all but the allowed syscalls.
@cd-work cd-work mentioned this issue Aug 28, 2023
Merged
@cd-work cd-work self-assigned this Aug 29, 2023
cd-work added a commit that referenced this issue Aug 30, 2023
@cd-work
Switch seccomp filter to whitelist
c13e2ef 
Previously the seccomp filter would use a whitelist, denying access only
to system calls known to perform network operations. This has the big
disadvantage that every new system call would be allowed by default.

To prevent accidentally opening up the sandbox due to not tracking the
Kernel appropriately, the filter has been switched to a whitelist
instead. This means only system calls which are explicitly present in
the list are allowed.

When the network sandbox is disabled, all system calls are allowed
regardless of our whitelist. This means that even new unknown system
calls will be allowed without having to update Birdcage to track them.

Closes #33.
@cd-work cd-work mentioned this issue Aug 30, 2023
Merged
cd-work added a commit that referenced this issue Aug 30, 2023
@cd-work
Switch seccomp filter to whitelist (#37)
dbfd7b9 
Previously the seccomp filter would use a whitelist, denying access only
to system calls known to perform network operations. This has the big
disadvantage that every new system call would be allowed by default.

To prevent accidentally opening up the sandbox due to not tracking the
Kernel appropriately, the filter has been switched to a whitelist
instead. This means only system calls which are explicitly present in
the list are allowed.

When the network sandbox is disabled, all system calls are allowed
regardless of our whitelist. This means that even new unknown system
calls will be allowed without having to update Birdcage to track them.

Closes #33.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@cd-work cd-work

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Switch seccomp filter to whitelist phylum-dev/birdcage
1 participant
@cd-work