3 ms·
That is the default in Docker.
by justincormack 10y ago
That is the default in Docker.
- geofft 10y agoThis is module auto-loading, i.e., you don't need CAP_SYS_MODULE, nor do you make an init_module syscall. The only syscall you make is socket(...IPPROTO_DCCP), and the kernel asks /sbin/modprobe (which it runs with full privileges) to load the appropriate module. The userspace program does not have any privileges. Does Docker actually block that? amluto's comment about the Timgad LSM implies that such functionality doesn't exist yet. (And the replies on LKML show the same confusion between explicit module loading, which requires privilege, and auto-loading, which does not. https://lkml.org/lkml/2017/2/6/279 https://lkml.org/lkml/2017/2/6/279) The easy way to try this is to lsmod and look for dccp and dccp_ipv4, `modprobe -r` them if they're already there, run python -c 'from socket import *; socket(AF_INET, 6, 33)' in your container, and lsmod again and see if they're present.
- justincormack 10y agoYeah true. Docker master has a seccomp profile that blocks this socket family though.