A seccomp filter is a policy that limits which system calls a process and its children may invoke. Podman uses this Linux kernel mechanism to remove hundreds of calls by default, reducing the calls available to container processes. section 10.9 section 1.2
Podman integrates seccomp with container security controls:
- Stores the default filter in /usr/share/containers/seccomp.json. section 10.9
- Adjusts permitted system calls when capabilities are added, while enforcing capabilities and seccomp separately. section 10.9
- Accepts a custom seccomp JSON file, although modifying filters is difficult because containers require different syscall sets. section 10.9
Blocking mkdir
Removing mkdir and mkdirat from a copied filter, then running `podman run --rm --security-opt seccomp=/tmp/seccomp.json ubi8 mkdir /foo`, causes the operation to fail with `Function not implemented`. section 10.9
Listing 10.12 How seccomp filters can block syscalls within a Podman container
$ sed '/mkdir/d' /usr/share/containers /seccomp.json > /tmp/seccomp.json #1 $ diff /usr/share/containers/seccomp.json/ tmp/seccomp.json #2 249,250d248 < "mkdir", < "mkdirat", $ podman run --rm --security-opt seccomp=/ tmp/seccomp.json ubi8 mkdir /foo #3 mkdir: cannot create directory '/foo': Function not implemented $ podman run --rm ubi8 mkdir /foo #4
Inspect the filter edit, comparison, and container command used to block directory creation. section 10.9
