mirror of
https://github.com/sol1/rustguac.git
synced 2026-10-26 05:29:51 +00:00
Jad Seifeddine
fbd249dd55
Docker's default seccomp profile only allows clone() and unshare() with namespace flags when the container has CAP_SYS_ADMIN. Chromium's namespace sandbox needs new user, PID and network namespaces, so under the default profile it falls back to the SUID chrome-sandbox helper. That fails too, because the container has no CAP_SYS_ADMIN, and every web session aborts with "Failed to move to new namespace ... errno = Operation not permitted". Until now the only way round it was to run the container with seccomp=unconfined. contrib/docker/seccomp-chromium.json is Docker's default profile (moby/profiles seccomp/v0.2.3) with two changes: - the clone rules also accept CLONE_NEWUSER, CLONE_NEWPID and CLONE_NEWNET; mount, UTS, IPC and cgroup namespaces stay refused - a matching rule allows unshare() for the same three namespace types With either change alone Chromium still fails to start. Requiring CLONE_NEWUSER on every such call is too strict, because the zygote later forks nested PID namespaces from inside its user namespace. Every other rule is unchanged, and the profile grants no capability. Refs #307