Skip to content

Security (Seccomp AF_ALG) #3

Security (Seccomp AF_ALG)

Security (Seccomp AF_ALG) #3

name: "Security (Seccomp AF_ALG)"
on:
push:
paths:
- 'pkg/docker/seccomp-no-af-alg.json'
- 'pkg/docker/Dockerfile.*'
- 'test/security/seccomp/**'
- '.github/workflows/security-seccomp.yml'
pull_request:
paths:
- 'pkg/docker/seccomp-no-af-alg.json'
- 'pkg/docker/Dockerfile.*'
- 'test/security/seccomp/**'
- '.github/workflows/security-seccomp.yml'
workflow_dispatch:
permissions:
contents: read
jobs:
seccomp-af-alg:
name: Verify AF_ALG seccomp mitigation
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- name: Pull test image
run: docker pull python:3.13-slim-trixie
- name: Validate JSON profile
run: python3 -m json.tool pkg/docker/seccomp-no-af-alg.json > /dev/null
- name: Run seccomp tests (python base image)
run: bash test/security/seccomp/test-af-alg.sh python:3.13-slim-trixie
# Build the image from the in-repo Dockerfile instead of pulling a
# published tag: this validates the Dockerfile under change (the very
# trigger of this workflow) and avoids coupling to the release that
# publishes the dash-style tags (latest-python-3.13-slim).
#
# The committed Dockerfile clones the pinned release tag, which does
# not exist yet while a release-prep PR is in flight (release-docker.yml
# rewrites the pin from the real tag at publish time). Retarget the
# source checkout at the code under test instead: the merge commit this
# check reports against (github.sha) -- the same tree actions/checkout
# built above -- rather than the unmerged PR-branch head.
- name: Point the source checkout at the code under test
env:
# Always the base repo + github.sha: on pull_request this is the PR
# *merge* commit (reachable from refs/pull/<n>/merge, so an anonymous
# fetch-by-SHA resolves it), matching actions/checkout above; on push
# it is the pushed commit. Both are pinned per run, so a later push
# cannot change what an already-queued run builds.
HEAD_URL: ${{ format('{0}/{1}', github.server_url, github.repository) }}
HEAD_SHA: ${{ github.sha }}
run: |
# Fetch the exact SHA this check reports against, not a moving
# branch tip (a later push to the branch must not change what an
# already-queued run builds).
sed -i \
-e "s|git clone --depth 1 -b [^ ]* [^ ]* unit|git init unit \&\& git -C unit fetch --depth 1 ${HEAD_URL} ${HEAD_SHA} \&\& git -C unit checkout --detach FETCH_HEAD|" \
pkg/docker/Dockerfile.python-3.13-slim
grep -F "git -C unit fetch --depth 1 ${HEAD_URL} ${HEAD_SHA}" \
pkg/docker/Dockerfile.python-3.13-slim
- name: Build FreeUnit python-3.13-slim image
run: docker build -t freeunit:seccomp-test -f pkg/docker/Dockerfile.python-3.13-slim pkg/docker
- name: Run seccomp tests (FreeUnit image)
run: bash test/security/seccomp/test-af-alg.sh freeunit:seccomp-test