Function TestExecSocketDenied

integration/container/exec_afalg_linux_test.go:66–156

TestExecSocketDenied verifies that AF_ALG and AF_VSOCK sockets cannot be created inside a container. AF_ALG is blocked by the default seccomp profile (via socket arg filtering) and by the default AppArmor profile (via "deny network alg"). AF_VSOCK is blocked by seccomp only.

(t *testing.T)

// (via socket arg filtering) and by the default AppArmor profile (via
// "deny network alg"). AF_VSOCK is blocked by seccomp only.
func TestExecSocketDenied(t *testing.T) {
	skip.If(t, testEnv.DaemonInfo.OSType != "linux")

	ctx := setupTest(t)
	apiClient := testEnv.APIClient()

	cID := container.Run(ctx, t, apiClient, container.WithImage("debian:trixie-slim"), container.WithCmd("sleep", "infinity"))

	// Install build dependencies as root.
	res := container.ExecT(ctx, t, apiClient, cID, []string{
		"sh", "-c", "apt-get update && apt-get install -y --no-install-recommends gcc libc-dev linux-libc-dev",
	})
	res.AssertSuccess(t)

	gcc := []string{"gcc"}

	arch := testEnv.DaemonInfo.Architecture
	isAmd64 := arch == "amd64" || arch == "x86_64"

	t.Run("AF_ALG", func(t *testing.T) {
		compileAndExecSocketDenied(ctx, t, apiClient, cID, "AF_ALG", afALGSource, gcc)
	})
	t.Run("AF_VSOCK", func(t *testing.T) {
		compileAndExecSocketDenied(ctx, t, apiClient, cID, "AF_VSOCK", afVSOCKSource, gcc)
	})

	// Test socketcall(2) via int $0x80 to invoke the ia32 compat syscall
	// path from a native 64-bit binary. MAP_32BIT is used to place the
	// args array below 4 GB since the ia32 compat path truncates all
	// registers to 32 bits.
	//
	// The socketcall binary is compiled with -DSOCK_FAMILY and -DSOCK_TYPE
	// to set the address family and socket type at compile time.
	t.Run("socketcall_int80", func(t *testing.T) {
		skip.If(t, !isAmd64, "int $0x80 ia32 compat only available on amd64")
		// Seccomp cannot filter socketcall arguments (the address family
		// is behind a userspace pointer). Only an LSM (AppArmor or
		// SELinux) can deny AF_ALG via the security_socket_create hook.
		hasLSM := slices.Contains(testEnv.DaemonInfo.SecurityOptions, "name=apparmor") ||
			slices.Contains(testEnv.DaemonInfo.SecurityOptions, "name=selinux")
		skip.If(t, !hasLSM, "socketcall filtering requires AppArmor or SELinux")

		srcPath := "/tmp/socketcall.c"
		res := container.ExecT(ctx, t, apiClient, cID, []string{
			"sh", "-c", "cat > " + srcPath + " << 'CEOF'\n" + socketcallSource + "\nCEOF",
		})
		res.AssertSuccess(t)

		// AF_ALG (38) via socketcall must be denied by the LSM
		// (AppArmor's "deny network alg" or SELinux's alg_socket deny),
		// which catches it at the security_socket_create hook even
		// though seccomp cannot filter socketcall args.
		t.Run("AF_ALG", func(t *testing.T) {
			binPath := "/tmp/socketcall_af_alg"
			res := container.ExecT(ctx, t, apiClient, cID, append(gcc,
				"-DSOCK_FAMILY=AF_ALG", "-DSOCK_TYPE=SOCK_SEQPACKET",
				"-include", "linux/if_alg.h",
				srcPath, "-o", binPath,