| From: |
| Jamie Hill-Daniel <clubby789-AT-gmail.com> |
| To: |
| Kees Cook <kees-AT-kernel.org>, Andy Lutomirski <luto-AT-amacapital.net>, Will Drewry <wad-AT-chromium.org> |
| Subject: |
| [PATCH v2 0/3] seccomp: Allow using SECCOMP_MODE_STRICT with SECCOMP_MODE_FILTER |
| Date: |
| Mon, 15 Jun 2026 17:20:20 +0100 |
| Message-ID: |
| <20260615-seccomp-combined-v2-0-41687a943ae0@hill-daniel.co.uk> |
| Cc: |
| linux-kernel-AT-vger.kernel.org, bpf-AT-vger.kernel.org, will-AT-willsroot.io, Jamie Hill-Daniel <jamie-AT-hill-daniel.co.uk> |
| Archive-link: |
| Article |
This patch adjusts the logic used by seccomp to allow applying both
SECCOMP_MODE_FILTER and SECCOMP_MODE_STRICT to the same process.
Currently, once seccomp has been initialized, a process may not
transition to a different mode (only add additional filters).
This means that in container environments such as Docker, which by
default runs with SECCOMP_MODE_FILTER, processes may not enable
SECCOMP_MODE_STRICT. This is an obstacle to using applications
requiring SECCOMP_MODE_STRICT in these environments, and requires
disabling these security measures.
This series adds a new 'strict upgrade' flag, which runs strict checks
after the filters.
Link: https://github.com/moby/moby/issues/42082
Signed-off-by: Jamie Hill-Daniel <jamie@hill-daniel.co.uk>
Reviewed-by: William Liu <will@willsroot.io>
---
Jamie Hill-Daniel (3):
seccomp: Store death as a separate field
seccomp: Allow upgrading to strict mode after enabling filters
selftest: seccomp: Adjust tests for using both STRICT and FILTER
include/linux/seccomp_types.h | 7 ++-
kernel/seccomp.c | 74 ++++++++++++---------------
tools/testing/selftests/seccomp/seccomp_bpf.c | 68 +++++++++++-------------
3 files changed, 68 insertions(+), 81 deletions(-)
---
base-commit: b9f0372b25cf3c41bf8eda02e65733afa5e8ad7c
change-id: 20260302-seccomp-combined-24bc3dbe32fd
Best regards,
--
Jamie Hill-Daniel <jamie@hill-daniel.co.uk>
