Repository navigation
config-linux: add linux.ioUring - #1328
Open
gvozdetsky wants to merge 2 commits into
Open
gvozdetsky wants to merge 2 commits into
gvozdetsky wants to merge 2 commits into
Conversation
gvozdetsky
requested review from
AkihiroSuda,
crosbymichael,
cyphar,
dqminh,
giuseppe,
hqhq,
kolyshkin,
mrunalp,
thaJeztah,
tianon and
utam0k
as code owners
October 13, 2026 13:00
gvozdetsky
added a commit
to gvozdetsky/youki
that referenced
this pull request
Oct 13, 2026
The proposed linux.ioUring says that whether an operation is allowed doesn't depend on its submission flags (opencontainers/runtime-spec#1328). Check it: a read with IOSQE_BUFFER_SELECT must be allowed. No buffers are registered, so the kernel answers -ENOBUFS, not -EACCES. A runtime that builds the allowlist with IORING_REGISTER_RESTRICTIONS would deny it, since that also denies every flag that isn't listed. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Eugene Gvozdetsky <gvozdet@gmail.com>
There was a problem hiding this comment.
🟡 Changes recommended
Go serialization currently converts an empty socket-family allowlist into an omitted, unrestricted policy.
1 open finding
What changed in this PR
Adds OCI configuration and feature reporting for Linux io_uring operation allowlists.
Changes:
- Defines
linux.ioUringand corresponding Go types. - Adds schemas, validation fixtures, and feature reporting.
- Documents enforcement semantics and examples.
| File | Description |
|---|---|
specs-go/features/features.go |
Adds io_uring feature reporting types. |
specs-go/config.go |
Adds io_uring configuration types. |
schema/test/config/good/linux-io-uring.json |
Adds valid configuration fixture. |
schema/test/config/bad/linux-io-uring.json |
Tests required ops. |
schema/test/config/bad/linux-io-uring-invalid-op.json |
Tests operation-name validation. |
schema/features-linux.json |
Defines feature schema. |
schema/defs-linux.json |
Defines operation and family patterns. |
schema/config-linux.json |
Defines configuration schema. |
features.md |
Extends the complete feature example. |
features-linux.md |
Documents feature reporting. |
config-linux.md |
Documents io_uring restrictions. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
gvozdetsky
added a commit
to gvozdetsky/youki
that referenced
this pull request
Oct 13, 2026
The proposed linux.ioUring no longer allows an empty socketFamilies (opencontainers/runtime-spec#1328). To deny all sockets, leave IORING_OP_SOCKET out of ops. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Eugene Gvozdetsky <gvozdet@gmail.com>
Restrict the io_uring operations a container can submit, using the io_uring task restrictions added in Linux 7.0. io_uring operations are not system calls, so seccomp cannot filter them. ops is an allowlist that doesn't depend on submission flags, so runtimes behave the same whether they use BPF filters or the task allowlist. An empty socketFamilies is not allowed: Go's omitempty would turn it into "any family". To deny all sockets, leave IORING_OP_SOCKET out of ops. Closes opencontainers#1323. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Eugene Gvozdetsky <gvozdet@gmail.com>
gvozdetsky
force-pushed
the
io-uring-restrictions
branch
from
October 13, 2026 14:25
cacd22a to
8c70401
Compare
gvozdetsky
added a commit
to gvozdetsky/youki
that referenced
this pull request
Oct 20, 2026
The proposed linux.ioUring now requires IORING_OP_SOCKET in ops when socketFamilies is set (opencontainers/runtime-spec#1328): a policy that limits the families of sockets it doesn't allow is most likely a mistake. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Eugene Gvozdetsky <gvozdet@gmail.com>
gvozdetsky
added a commit
to gvozdetsky/crun
that referenced
this pull request
Oct 20, 2026
linux: add experimental io_uring restrictions seccomp cannot filter io_uring operations, as they are submitted through the ring and not as syscalls, so today the only option is to block io_uring entirely. Linux 7.0 added task-level io_uring BPF filters, which are inherited across fork and exec and can only be tightened, like seccomp. Add the run.oci.io_uring annotation, in the shape proposed for linux.ioUring in opencontainers/runtime-spec#1328: {"ops": [...], "socketFamilies": [...]} ops is an allowlist of IORING_OP_* names, every other operation is denied. socketFamilies, when present, limits IORING_OP_SOCKET to the listed address families. It must not be empty, and ops must contain IORING_OP_SOCKET. The policy is validated, and kernel support checked, before the container is created or restored, and before a process is exec'ed in it. Registering a filter needs either no_new_privs or CAP_SYS_ADMIN, so, like seccomp, the restrictions are applied to the container init and to every exec'ed process before the capabilities are dropped, or with noNewPrivileges once no_new_privs is set. In both cases they are applied before seccomp, which may deny io_uring_register. CRIU does not restore them, so on restore crun applies them to itself before running CRIU, and the restored processes inherit them. Only BPF filters are used, never IORING_REGISTER_RESTRICTIONS, so the SQE flags are not restricted and the workload can still add its own filters. The annotation will be replaced by linux.ioUring once it is in the runtime spec. Assisted-by: Claude Code (claude-opus-5-5) Signed-off-by: Eugene Gvozdetsky <gvozdet@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
linux.ioUring, an allowlist of io_uring operations for the container, based on the task restrictions added in Linux 7.0. Closes #1323.Compared to the issue,
defaultActionanddeniedSqeFlagsare dropped and register opcodes are out of scope. All of them can be added later without breaking existing configs.Implementation: youki-dev/youki#3805 (draft, uses an annotation until this is merged).
On 7.0 and 7.1 without bc0e8faf90e7, restrictions are lost on exec. The spec doesn't mention kernel versions, so detecting this is left to runtimes.