Post #1846159

What I learned from patching Docker Engine default seccomp profile for CVE-2026-31431 (Copy Fail) 1. If a seccomp rule already filters an argument (like AF_VSOCK), it's just a matter of adding a second negation for the AF_ALG, right? Wrong! These are two rules that are OR'd. Effectively breaking the previous single negation. The right fix was to reshape it into a range check with the gt/lt opcode: - "arg0 40" That cleanly leaves both "AF_ALG" (38) and "AF_VSOCK" (40) unmatched, so they fall through to deny. 2. There's also a second syscall... Filtering socket(2) alone is not enough. On x86 (and some other platforms) there's also a legacy predecessors to socket syscall called socketcall(2). On amd64 it can still be used if the process switches to the ia32 compat mode (with int 80h). Unfortunately it must be blocked completely because the pointer argument cannot be inspected by seccomp. This only impacts very old 32 bit binaries though. 3. The error you return matters If you block socketcall by returning EPERM, the libseccomp will automatically happily generate an ALLOW rule for the socket(2). Not sure about the full reasoning behind it yet, but ENOSYS works fine. Now.. time to enjoy the long weekend