Bug #1639407 “Docker not built with seccomp” : Bugs : docker.io package : Ubuntu

Revision history for this message

Emily Ratliff (emilyr) wrote on 2016-11-07:

#1

Thanks for the report, Lizzie. I've subscribed the Docker Ubuntu Maintainers so that they can have a look and comment.

Revision history for this message

Tianon Gravi (tianon) wrote on 2016-11-07:

#2

I don't know much about /proc/<pid>/status, but I'm fairly certain we compile Docker with whatever seccomp support is available from upstream. Can you share the output of "docker info", especially the "Security Options" field?

Revision history for this message

Lizzie Dixon (l-zzie) wrote on 2016-11-07:

#3

Download full text (6.3 KiB)

Here's the version I have installed and 'docker info':

    ubuntu@ubuntu-yakkety:~$ dpkg -s docker.io
    Package: docker.io
    Status: install ok installed
    Priority: optional
    Section: admin
    Installed-Size: 77442
    Maintainer: Ubuntu Developers <email address hidden>
    Architecture: amd64
    Version: 1.12.1-0ubuntu15
    Replaces: docker (<< 1.5~)
    Depends: adduser, containerd (>= 0.2.3~), iptables, runc (>= 1.0.0~rc1~), init-system-helpers (>= 1.18~), libapparmor1 (>= 2.6~devel), libc6 (>= 2.14), libdevmapper1.02.1 (>= 2:1.02.97)
    Recommends: ca-certificates, cgroupfs-mount | cgroup-lite, git, ubuntu-fan, xz-utils, apparmor
    Suggests: aufs-tools, btrfs-tools, debootstrap, docker-doc, rinse, zfs-fuse | zfsutils
    Breaks: docker (<< 1.5~)
    Conffiles:
     /etc/default/docker 4ed438ab743c3abef1a1006fa57b05cd
     /etc/init.d/docker 73e254995b37e21ac3b63825a3b28704
     /etc/init/docker.conf 8ce66c020d5e129a177a87e0c504439c
    Description: Linux container runtime
     Docker complements kernel namespacing with a high-level API which operates at
     the process level. It runs unix processes with strong guarantees of isolation
     and repeatability across servers.
     .
     Docker is a great building block for automating distributed systems:
     large-scale web deployments, database clusters, continuous deployment systems,
     private PaaS, service-oriented architectures, etc.
     .
     This package contains the daemon and client. Using docker.io on non-amd64 hosts
     is not supported at this time. Please be careful when using it on anything
     besides amd64.
     .
     Also, note that kernel version 3.8 or above is required for proper operation of
     the daemon process, and that any lower versions may have subtle and/or glaring
     issues.
    Built-Using: glibc (= 2.24-3ubuntu1), golang-1.6 (= 1.6.3-1ubuntu1)
    Homepage: https://dockerproject.org
    Original-Maintainer: Paul Tagliamonte <email address hidden>
    ubuntu@ubuntu-yakkety:~$ docker info
    Cannot connect to the Docker daemon. Is the docker daemon running on this host?
    ubuntu@ubuntu-yakkety:~$ sudo docker info
    Containers: 0
     Running: 0
     Paused: 0
     Stopped: 0
    Images: 0
    Server Version: 1.12.1
    Storage Driver: overlay
     Backing Filesystem: extfs
    Logging Driver: json-file
    Cgroup Driver: cgroupfs
    Plugins:
     Volume: local
     Network: host bridge overlay null
    Swarm: inactive
    Runtimes: runc
    Default Runtime: runc
    Security Options: apparmor
    Kernel Version: 4.8.0-26-generic
    Operating System: Ubuntu 16.10
    OSType: linux
    Architecture: x86_64
    CPUs: 2
    Total Memory: 991.7 MiB
    Name: ubuntu-yakkety
    ID: G6JA:MD2U:CD45:5DC3:DFZ3:GUNY:IDH7:HYP5:C4J5:TOSZ:ZFE4:ZK6K
    Docker Root Dir: /var/lib/docker
    Debug Mode (client): false
    Debug Mode (server): false
    Registry: https://index.docker.io/v1/
    WARNING: No swap limit support
    Insecure Registries:
     127.0.0.0/8

Here's what happens if I try to specify a seccomp profile:

ubuntu@ubuntu-yakkety:~$ curl -L -O https://raw.githubusercontent.com/docker/docker/master/profile...

Here's the version I have installed and 'docker info':

ubuntu@ubuntu-yakkety:~$ dpkg -s docker.io 
    Package: docker.io
    Status: install ok installed
    Priority: optional
    Section: admin
    Installed-Size: 77442
    Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
    Architecture: amd64
    Version: 1.12.1-0ubuntu15
    Replaces: docker (<< 1.5~)
    Depends: adduser, containerd (>= 0.2.3~), iptables, runc (>= 1.0.0~rc1~), init-system-helpers (>= 1.18~), libapparmor1 (>= 2.6~devel), libc6 (>= 2.14), libdevmapper1.02.1 (>= 2:1.02.97)
    Recommends: ca-certificates, cgroupfs-mount | cgroup-lite, git, ubuntu-fan, xz-utils, apparmor
    Suggests: aufs-tools, btrfs-tools, debootstrap, docker-doc, rinse, zfs-fuse | zfsutils
    Breaks: docker (<< 1.5~)
    Conffiles:
     /etc/default/docker 4ed438ab743c3abef1a1006fa57b05cd
     /etc/init.d/docker 73e254995b37e21ac3b63825a3b28704
     /etc/init/docker.conf 8ce66c020d5e129a177a87e0c504439c
    Description: Linux container runtime
     Docker complements kernel namespacing with a high-level API which operates at
     the process level. It runs unix processes with strong guarantees of isolation
     and repeatability across servers.
     .
     Docker is a great building block for automating distributed systems:
     large-scale web deployments, database clusters, continuous deployment systems,
     private PaaS, service-oriented architectures, etc.
     .
     This package contains the daemon and client. Using docker.io on non-amd64 hosts
     is not supported at this time. Please be careful when using it on anything
     besides amd64.
     .
     Also, note that kernel version 3.8 or above is required for proper operation of
     the daemon process, and that any lower versions may have subtle and/or glaring
     issues.
    Built-Using: glibc (= 2.24-3ubuntu1), golang-1.6 (= 1.6.3-1ubuntu1)
    Homepage: https://dockerproject.org
    Original-Maintainer: Paul Tagliamonte <paultag@debian.org>
    ubuntu@ubuntu-yakkety:~$ docker info
    Cannot connect to the Docker daemon. Is the docker daemon running on this host?
    ubuntu@ubuntu-yakkety:~$ sudo docker info
    Containers: 0
     Running: 0
     Paused: 0
     Stopped: 0
    Images: 0
    Server Version: 1.12.1
    Storage Driver: overlay
     Backing Filesystem: extfs
    Logging Driver: json-file
    Cgroup Driver: cgroupfs
    Plugins:
     Volume: local
     Network: host bridge overlay null
    Swarm: inactive
    Runtimes: runc
    Default Runtime: runc
    Security Options: apparmor
    Kernel Version: 4.8.0-26-generic
    Operating System: Ubuntu 16.10
    OSType: linux
    Architecture: x86_64
    CPUs: 2
    Total Memory: 991.7 MiB
    Name: ubuntu-yakkety
    ID: G6JA:MD2U:CD45:5DC3:DFZ3:GUNY:IDH7:HYP5:C4J5:TOSZ:ZFE4:ZK6K
    Docker Root Dir: /var/lib/docker
    Debug Mode (client): false
    Debug Mode (server): false
    Registry: https://index.docker.io/v1/
    WARNING: No swap limit support
    Insecure Registries:
     127.0.0.0/8

Here's what happens if I try to specify a seccomp profile:

ubuntu@ubuntu-yakkety:~$ curl -L -O https://raw.githubusercontent.com/docker/docker/master/profiles/seccomp/default.json
      % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                     Dload  Upload   Total   Spent    Left  Speed
    100 10755  100 10755    0     0   5517      0  0:00:01  0:00:01 --:--:--  5515
    (failed reverse-i-search)`sudo docker run b': ^Cdo docker info
    ubuntu@ubuntu-yakkety:~$ sudo docker run -it --security-opt seccomp=default.json ubuntu -i /bin/bash
    Unable to find image 'ubuntu:latest' locally
    latest: Pulling from library/ubuntu
    6bbedd9b76a4: Pull complete 
    fc19d60a83f1: Pull complete 
    de413bb911fd: Pull complete 
    2879a7ad3144: Pull complete 
    668604fde02e: Pull complete 
    Digest: sha256:2d44ae143feeb36f4c898d32ed2ab2dffeb3a573d2d8928646dfc9cb7deb1315
    Status: Downloaded newer image for ubuntu:latest
    docker: Error response from daemon: linux seccomp: seccomp profiles are not supported on this daemon, you cannot specify a custom seccomp profile.
    ubuntu@ubuntu-yakkety:~$

You can find documentation about /proc/self/status here:
https://www.kernel.org/doc/Documentation/filesystems/proc.txt

The relevant part is:

Seccomp                     seccomp mode, like prctl(PR_GET_SECCOMP, ...)

'man 2 prctl' (http://man7.org/linux/man-pages/man2/prctl.2.html) says

PR_SET_SECCOMP (since Linux 2.6.23)
              Set the secure computing (seccomp) mode for the calling thread, to limit the available system calls.   The  more
              recent seccomp(2) system call provides a superset of the functionality of PR_SET_SECCOMP.

The seccomp mode is selected via arg2.  (The seccomp constants are defined in <linux/seccomp.h>.)

With  arg2  set  to SECCOMP_MODE_STRICT, the only system calls that the thread is permitted to make are read(2),
              write(2), _exit(2) (but not exit_group(2)), and sigreturn(2).  Other system calls result in the  delivery  of  a
              SIGKILL  signal.  Strict secure computing mode is useful for number-crunching applications that may need to exe‐
              cute untrusted byte code, perhaps obtained by reading from a pipe or socket.  This operation is  available  only
              if the kernel is configured with CONFIG_SECCOMP enabled.

With  arg2  set to SECCOMP_MODE_FILTER (since Linux 3.5), the system calls allowed are defined by a pointer to a
              Berkeley Packet Filter passed in arg3.  This argument is a pointer to struct sock_fprog; it can be  designed  to
              filter  arbitrary  system calls and system call arguments.  This mode is available only if the kernel is config‐
              ured with CONFIG_SECCOMP_FILTER enabled.

If SECCOMP_MODE_FILTER filters permit fork(2), then the  seccomp  mode  is  inherited  by  children  created  by
              fork(2);  if execve(2) is permitted, then the seccomp mode is preserved across execve(2).  If the filters permit
              prctl() calls, then additional filters can be added; they are run in order until the first non-allow  result  is
              seen.

For further information, see the kernel source file Documentation/prctl/seccomp_filter.txt.

Revision history for this message

Robie Basak (racb) wrote on 2016-11-08:

#4

Subscribing Jon Grimm. He's the Canonical Server Team manager and can help make sure this doesn't get lost! I'm just drive-by triaging, and this appeared in my triage report as I happen to also be in ~docker-maint.

Revision history for this message

Lizzie Dixon (l-zzie) wrote on 2016-11-29:

#5

Hello,

Do you have any more information?

Can you confirm whether this has been reproduced?

Do you know whether this is done intentionally?

Could this bug be opened, so I have a place to point others to when it comes up?

Seth Arnold (seth-arnold) on 2016-11-29

information type:

Private Security → Public Security

Revision history for this message

Tianon Gravi (tianon) wrote on 2016-11-29:

#6

This is definitely a real issue, and it wasn't intentional -- I've got a fix in progress, but it needs to happen in both the runc and the docker.io packages.

Changed in docker.io (Ubuntu):
status:	New → Confirmed
Changed in runc (Ubuntu):
status:	New → Confirmed

Revision history for this message

Lizzie Dixon (l-zzie) wrote on 2016-11-30:

#7

Thanks for the update!

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-12-14:

#8

This bug was fixed in the package runc - 1.0.0~rc1-0ubuntu2

---------------
runc (1.0.0~rc1-0ubuntu2) zesty; urgency=medium

[ Tianon Gravi ]
* Enable seccomp support (LP: #1639407)

-- Steve Langasek <email address hidden> Wed, 30 Nov 2016 12:31:01 -0800

Changed in runc (Ubuntu):
status:	Confirmed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-12-14:

#9

This bug was fixed in the package docker.io - 1.12.3-0ubuntu4

---------------
docker.io (1.12.3-0ubuntu4) zesty; urgency=medium

* Explicity depend on the version of runc that was built with seccomp
support.

-- Michael Hudson-Doyle <email address hidden> Mon, 12 Dec 2016 11:15:01 +1300

Changed in docker.io (Ubuntu):
status:	Confirmed → Fix Released

Michael Hudson-Doyle (mwhudson) on 2016-12-15

Changed in docker.io (Ubuntu Xenial):
status:	New → In Progress
Changed in docker.io (Ubuntu Yakkety):
status:	New → In Progress
Changed in runc (Ubuntu Xenial):
status:	New → In Progress
Changed in runc (Ubuntu Yakkety):
status:	New → In Progress

Michael Hudson-Doyle (mwhudson) on 2016-12-15

description:

updated

Revision history for this message

Brian Murray (brian-murray) wrote on 2016-12-15: Please test proposed package

#10

Hello Lizzie, or anyone else affected,

Accepted docker.io into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/docker.io/1.12.3-0ubuntu4~16.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in docker.io (Ubuntu Yakkety):
status:	In Progress → Fix Committed
tags:	added: verification-needed

Revision history for this message

Brian Murray (brian-murray) wrote on 2016-12-15:

#11

Hello Lizzie, or anyone else affected,

Accepted runc into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/runc/1.0.0~rc1-0ubuntu2~16.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in runc (Ubuntu Yakkety):
status:	In Progress → Fix Committed

Revision history for this message

Andy Whitcroft (apw) wrote on 2017-01-09:

#12

Hello Lizzie, or anyone else affected,

Accepted docker.io into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/docker.io/1.12.3-0ubuntu4~16.10.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Revision history for this message

Andy Whitcroft (apw) wrote on 2017-01-11:

#13

Hello Lizzie, or anyone else affected,

Accepted docker.io into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/docker.io/1.12.3-0ubuntu4~16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in docker.io (Ubuntu Xenial):
status:	In Progress → Fix Committed

Revision history for this message

Andy Whitcroft (apw) wrote on 2017-01-16:

#14

Hello Lizzie, or anyone else affected,

Accepted runc into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/runc/1.0.0~rc1-0ubuntu2~16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in runc (Ubuntu Xenial):
status:	In Progress → Fix Committed

Revision history for this message

Michael Hudson-Doyle (mwhudson) wrote on 2017-01-16:

#15

$ docker run -it ubuntu grep Seccomp /proc/self/status
Seccomp: 2

tags:

added: verification-done-xenial verification-done-yakkety
removed: verification-needed

Revision history for this message

Michael Hudson-Doyle (mwhudson) wrote on 2017-01-16:

#16

(I've run this on my xenial system and a yakkety vm)

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-01-18:

#17

This bug was fixed in the package runc - 1.0.0~rc1-0ubuntu2~16.04.1

---------------
runc (1.0.0~rc1-0ubuntu2~16.04.1) xenial; urgency=medium

* Backport to Xenial. (LP: #1639407)

-- Michael Hudson-Doyle <email address hidden> Thu, 15 Dec 2016 13:33:42 +1300

Changed in runc (Ubuntu Xenial):
status:	Fix Committed → Fix Released

Revision history for this message

Chris J Arges (arges) wrote on 2017-01-18: Update Released

#18

The verification of the Stable Release Update for runc has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-01-18:

#19

This bug was fixed in the package runc - 1.0.0~rc1-0ubuntu2~16.10.1

---------------
runc (1.0.0~rc1-0ubuntu2~16.10.1) yakkety; urgency=medium

* Backport to Yakkety. (LP: #1639407)

-- Michael Hudson-Doyle <email address hidden> Thu, 15 Dec 2016 13:33:42 +1300

Changed in runc (Ubuntu Yakkety):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-01-18:

#20

This bug was fixed in the package docker.io - 1.12.3-0ubuntu4~16.10.2

---------------
docker.io (1.12.3-0ubuntu4~16.10.2) yakkety; urgency=medium

* Update runc dep to account for its backported version.

docker.io (1.12.3-0ubuntu4~16.10.1) yakkety; urgency=medium

* Backport to Yakkety. (LP: #1647376, #1639407)

-- Michael Hudson-Doyle <email address hidden> Mon, 19 Dec 2016 09:20:48 +1300

Changed in docker.io (Ubuntu Yakkety):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-01-18:

#21

This bug was fixed in the package docker.io - 1.12.3-0ubuntu4~16.04.2

---------------
docker.io (1.12.3-0ubuntu4~16.04.2) xenial; urgency=medium

* Update runc dep to account for its backported version.

-- Michael Hudson-Doyle <email address hidden> Mon, 19 Dec 2016 09:20:48 +1300

Changed in docker.io (Ubuntu Xenial):
status:	Fix Committed → Fix Released

	Status	Importance	Assigned to
docker.io (Ubuntu)	Fix Released	Undecided	Unassigned
Xenial	Fix Released	Undecided	Unassigned
Yakkety	Fix Released	Undecided	Unassigned
runc (Ubuntu)	Fix Released	Undecided	Unassigned
Xenial	Fix Released	Undecided	Unassigned
Yakkety	Fix Released	Undecided	Unassigned

Ubuntu
docker.io package

Docker not built with seccomp

Bug Description

Other bug subscribers

Remote bug watches

Ubuntudocker.io package

Docker not built with seccomp

Bug Description

Other bug subscribers

Remote bug watches

Ubuntu
docker.io package