{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/22664","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/22664/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/22664/comments","events_url":"https://api.github.com/repos/docker/docker/issues/22664/events","html_url":"https://github.com/docker/docker/issues/22664","id":154243332,"number":22664,"title":"[seccomp] Should modify_ldt by allowed by default?","user":{"login":"BenHall","id":82614,"avatar_url":"https://avatars.githubusercontent.com/u/82614?v=3","gravatar_id":"","url":"https://api.github.com/users/BenHall","html_url":"https://github.com/BenHall","followers_url":"https://api.github.com/users/BenHall/followers","following_url":"https://api.github.com/users/BenHall/following{/other_user}","gists_url":"https://api.github.com/users/BenHall/gists{/gist_id}","starred_url":"https://api.github.com/users/BenHall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BenHall/subscriptions","organizations_url":"https://api.github.com/users/BenHall/orgs","repos_url":"https://api.github.com/users/BenHall/repos","events_url":"https://api.github.com/users/BenHall/events{/privacy}","received_events_url":"https://api.github.com/users/BenHall/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-05-11T13:27:12Z","updated_at":"2016-05-11T16:48:57Z","closed_at":null,"body":"I was just looking into CVE-2015-5157. It seems to be a problem because modify_ldt syscall is allowed by default (https://github.com/docker/docker/blob/master/profiles/seccomp/default.json).\r\n\r\nHowever, on the docs page it says it should be blocked by default (https://docs.docker.com/engine/security/seccomp/) because \"Old syscall only used in 16-bit code and a potential information leak.\" which sounds like a sensible reason.\r\n\r\nSo why is the call allowed in default.json? "},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/218519460","html_url":"https://github.com/docker/docker/issues/22664#issuecomment-218519460","issue_url":"https://api.github.com/repos/docker/docker/issues/22664","id":218519460,"user":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"created_at":"2016-05-11T16:48:57Z","updated_at":"2016-05-11T16:48:57Z","body":"created a pull request to update the docs; https://github.com/docker/docker/pull/22669"}}