chore: Harden kernel + searcher container against AF_ALG/algif_* bug class#142

Open

MoeMahhouk wants to merge 13 commits into

mainfrom

moe/copy-fail-defense-in-depth

Commits on May 27, 2026

Block AF_ALG (family 38) in searcher container seccomp profile

MoeMahhouk
authored and
shashial
committed
Drop CONFIG_CRYPTO_USER_API_* (no consumer on this image)

MoeMahhouk
authored and
shashial
committed
Pin CONFIG_CRYPTO_AUTHENCESN off (no in-tree consumer)

MoeMahhouk
authored and
shashial
committed
Block AF_RXRPC (family 45) and AF_KEY (family 15) in searcher container seccomp profile

MoeMahhouk
authored and
shashial
committed
Pin AF_RXRPC, RXKAD, XFRM_USER off (no consumer on any image)

MoeMahhouk
authored and
shashial
committed
Pin XFRM core/algo/espintcp off (close inference gap)

MoeMahhouk
authored and
shashial
committed
Disable default-on zero-copy receive (IO_URING + IO_URING_ZCRX + NET_DEVMEM)

MoeMahhouk
authored and
shashial
committed
Re-enable CRYPTO_USER_API_{HASH,SKCIPHER} -- required by cryptsetup

MoeMahhouk
authored and
shashial
committed
seccomp: sync default profile to moby/profiles + layer family deny rules
shashial
committed
kernel: pin CONFIG_MCTP=n
shashial
committed
add more syscalls and kernel config options
shashial
committed
shrink rules
shashial
committed
add regression-check python script
shashial
committed