Container Service for Kubernetes:Aviso de segurança: CVE-2026-31431

Pré-requisitos

Antes de começar, confirme os seguintes pontos:

• Suas cargas de trabalho não dependem do módulo de kernel AF_ALG (usado para aceleração criptográfica em espaço de kernel, como IPsec ou libkcapi).

• Nenhum outro perfil seccomp do tipo Localhost está configurado no campo securityContext.seccompProfile dos Pods da sua carga de trabalho.

1. Implantar o DaemonSet seccomp

Este DaemonSet grava um arquivo de política seccomp em cada nó Linux do seu cluster. Após a criação do arquivo, aplique a política referenciando-a nos Pods da sua carga de trabalho, conforme descrito na Etapa 2.

1. Salve o manifesto YAML a seguir como seccomp-block-AF_ALG.yaml.

   O DaemonSet grava o arquivo seccomp-block-af_alg.json no caminho /var/lib/kubelet/seccomp/profiles/ de todos os nós Linux.

   YAML

   apiVersion: apps/v1
   kind: DaemonSet
   metadata:
     name: ack-cve-2026-31431-mitigate
     namespace: kube-system
     labels:
       app: ack-cve-2026-31431-mitigate
   spec:
     selector:
       matchLabels:
         app: ack-cve-2026-31431-mitigate
     template:
       metadata:
         labels:
           app: ack-cve-2026-31431-mitigate
       spec:
         priorityClassName: system-node-critical
         nodeSelector:
           kubernetes.io/os: linux
         tolerations:
           - operator: Exists
         containers:
           - name: mitigate
             image: registry-cn-hangzhou.ack.aliyuncs.com/acs/busybox:1.35
             command:
               - /bin/sh
               - -c
               - |
                 echo "=== CVE-2026-31431 Mitigation ==="
   
                 cat <<EOF > /kubelet-seccomp/seccomp-block-af_alg.json
                 {
                   "defaultAction": "SCMP_ACT_ERRNO",
                   "architectures": [
                     "SCMP_ARCH_X86_64",
                     "SCMP_ARCH_X86",
                     "SCMP_ARCH_X32",
                     "SCMP_ARCH_AARCH64",
                     "SCMP_ARCH_ARM"
                   ],
                   "syscalls": [
                     {
                       "names": ["socket"],
                       "action": "SCMP_ACT_ERRNO",
                       "args": [
                         {
                           "index": 0,
                           "value": 38,
                           "op": "SCMP_CMP_EQ"
                         }
                       ]
                     },
                     {
                       "names": ["socket"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [
                         {
                           "index": 0,
                           "value": 40,
                           "op": "SCMP_CMP_NE"
                         }
                       ]
                     },
                     {
                       "names": [
                         "accept", "accept4", "access", "adjtimex", "alarm", "bind", "brk",
                         "cachestat", "capget", "capset", "chdir", "chmod", "chown", "chown32",
                         "clock_adjtime", "clock_adjtime64", "clock_getres", "clock_getres_time64",
                         "clock_gettime", "clock_gettime64", "clock_nanosleep", "clock_nanosleep_time64",
                         "close", "close_range", "connect", "copy_file_range", "creat",
                         "dup", "dup2", "dup3",
                         "epoll_create", "epoll_create1", "epoll_ctl", "epoll_ctl_old",
                         "epoll_pwait", "epoll_pwait2", "epoll_wait", "epoll_wait_old",
                         "eventfd", "eventfd2", "execve", "execveat", "exit", "exit_group",
                         "faccessat", "faccessat2", "fadvise64", "fadvise64_64", "fallocate",
                         "fanotify_mark", "fchdir", "fchmod", "fchmodat", "fchmodat2",
                         "fchown", "fchown32", "fchownat", "fcntl", "fcntl64", "fdatasync",
                         "fgetxattr", "flistxattr", "flock", "fork", "fremovexattr", "fsetxattr",
                         "fstat", "fstat64", "fstatat64", "fstatfs", "fstatfs64", "fsync",
                         "ftruncate", "ftruncate64",
                         "futex", "futex_requeue", "futex_time64", "futex_wait", "futex_waitv", "futex_wake",
                         "futimesat", "getcpu", "getcwd", "getdents", "getdents64",
                         "getegid", "getegid32", "geteuid", "geteuid32",
                         "getgid", "getgid32", "getgroups", "getgroups32", "getitimer",
                         "getpeername", "getpgid", "getpgrp", "getpid", "getppid", "getpriority",
                         "getrandom", "getresgid", "getresgid32", "getresuid", "getresuid32",
                         "getrlimit", "get_robust_list", "getrusage", "getsid", "getsockname",
                         "getsockopt", "get_thread_area", "gettid", "gettimeofday",
                         "getuid", "getuid32", "getxattr", "getxattrat",
                         "inotify_add_watch", "inotify_init", "inotify_init1", "inotify_rm_watch",
                         "io_cancel", "ioctl", "io_destroy", "io_getevents",
                         "io_pgetevents", "io_pgetevents_time64", "ioprio_get", "ioprio_set",
                         "io_setup", "io_submit", "ipc", "kill",
                         "landlock_add_rule", "landlock_create_ruleset", "landlock_restrict_self",
                         "lchown", "lchown32", "lgetxattr", "link", "linkat", "listen",
                         "listmount", "listxattr", "listxattrat", "llistxattr", "_llseek",
                         "lremovexattr", "lseek", "lsetxattr",
                         "lsm_get_self_attr", "lsm_list_modules", "lsm_set_self_attr",
                         "lstat", "lstat64", "madvise", "membarrier", "memfd_create", "memfd_secret",
                         "mincore", "mkdir", "mkdirat", "mknod", "mknodat",
                         "mlock", "mlock2", "mlockall", "map_shadow_stack",
                         "mmap", "mmap2", "mprotect",
                         "mq_getsetattr", "mq_notify", "mq_open",
                         "mq_timedreceive", "mq_timedreceive_time64",
                         "mq_timedsend", "mq_timedsend_time64", "mq_unlink",
                         "mremap", "mseal", "msgctl", "msgget", "msgrcv", "msgsnd", "msync",
                         "munlock", "munlockall", "munmap",
                         "name_to_handle_at", "nanosleep", "newfstatat", "_newselect",
                         "open", "openat", "openat2", "pause",
                         "pidfd_open", "pidfd_send_signal", "pipe", "pipe2",
                         "pkey_alloc", "pkey_free", "pkey_mprotect",
                         "poll", "ppoll", "ppoll_time64", "prctl",
                         "pread64", "preadv", "preadv2", "prlimit64",
                         "process_mrelease", "pselect6", "pselect6_time64",
                         "pwrite64", "pwritev", "pwritev2",
                         "read", "readahead", "readlink", "readlinkat", "readv",
                         "recv", "recvfrom", "recvmmsg", "recvmmsg_time64", "recvmsg",
                         "remap_file_pages", "removexattr", "removexattrat",
                         "rename", "renameat", "renameat2", "restart_syscall", "rmdir", "rseq",
                         "rt_sigaction", "rt_sigpending", "rt_sigprocmask", "rt_sigqueueinfo",
                         "rt_sigreturn", "rt_sigsuspend", "rt_sigtimedwait", "rt_sigtimedwait_time64",
                         "rt_tgsigqueueinfo",
                         "sched_getaffinity", "sched_getattr", "sched_getparam",
                         "sched_get_priority_max", "sched_get_priority_min", "sched_getscheduler",
                         "sched_rr_get_interval", "sched_rr_get_interval_time64",
                         "sched_setaffinity", "sched_setattr", "sched_setparam",
                         "sched_setscheduler", "sched_yield", "seccomp", "select",
                         "semctl", "semget", "semop", "semtimedop", "semtimedop_time64",
                         "send", "sendfile", "sendfile64", "sendmmsg", "sendmsg", "sendto",
                         "setfsgid", "setfsgid32", "setfsuid", "setfsuid32",
                         "setgid", "setgid32", "setgroups", "setgroups32", "setitimer", "setpgid",
                         "setpriority", "setregid", "setregid32", "setresgid", "setresgid32",
                         "setresuid", "setresuid32", "setreuid", "setreuid32", "setrlimit",
                         "set_robust_list", "setsid", "setsockopt", "set_thread_area",
                         "set_tid_address", "setuid", "setuid32", "setxattr", "setxattrat",
                         "shmat", "shmctl", "shmdt", "shmget", "shutdown",
                         "sigaltstack", "signalfd", "signalfd4", "sigprocmask", "sigreturn",
                         "socketcall", "socketpair", "splice",
                         "stat", "stat64", "statfs", "statfs64", "statmount", "statx",
                         "symlink", "symlinkat", "sync", "sync_file_range", "syncfs", "sysinfo",
                         "tee", "tgkill", "time",
                         "timer_create", "timer_delete", "timer_getoverrun",
                         "timer_gettime", "timer_gettime64", "timer_settime", "timer_settime64",
                         "timerfd_create", "timerfd_gettime", "timerfd_gettime64",
                         "timerfd_settime", "timerfd_settime64",
                         "times", "tkill", "truncate", "truncate64", "ugetrlimit", "umask",
                         "uname", "unlink", "unlinkat", "uretprobe",
                         "utime", "utimensat", "utimensat_time64", "utimes",
                         "vfork", "vmsplice", "wait4", "waitid", "waitpid", "write", "writev",
                         "bpf", "chroot", "clone3", "fanotify_init", "fsconfig", "fsmount",
                         "fsopen", "fspick", "get_mempolicy", "io_uring_enter", "io_uring_register",
                         "io_uring_setup", "iopl", "ioperm", "kcmp", "keyctl", "add_key",
                         "request_key", "lookup_dcookie", "mbind", "migrate_pages", "mount",
                         "mount_setattr", "move_mount", "umount2", "move_pages", "nfsservctl",
                         "open_tree", "perf_event_open", "pidfd_getfd", "pivot_root",
                         "process_vm_readv", "process_vm_writev", "ptrace", "quotactl",
                         "quotactl_fd", "reboot", "set_mempolicy", "set_mempolicy_home_node",
                         "setdomainname", "sethostname", "setns", "swapon", "swapoff",
                         "syslog", "unshare", "userfaultfd", "vhangup"
                       ],
                       "action": "SCMP_ACT_ALLOW"
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 0, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 8, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 131072, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 131080, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 4294967295, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["clone"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 2114060288, "op": "SCMP_CMP_MASKED_EQ", "valueTwo": 0 }]
                     },
                     {
                       "names": ["arch_prctl"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 4114, "op": "SCMP_CMP_NE" }]
                     }
                   ]
                 }
   
                 EOF
   
                 echo "=== Mitigation complete. Ensure your Pod's securityContext is configured to use this seccomp profile (type: Localhost, localhostProfile: profiles/seccomp-block-af_alg.json). Sleeping to keep the DaemonSet running. ==="
                 sleep infinity
             resources:
               requests:
                 cpu: 10m
                 memory: 16Mi
               limits:
                 memory: 32Mi
             volumeMounts:
               - name: kubelet-seccomp-root
                 mountPath: /kubelet-seccomp
         volumes:
           - name: kubelet-seccomp-root
             hostPath:
               path: /var/lib/kubelet/seccomp/profiles
               type: DirectoryOrCreate

2. Aplique o manifesto para implantar o DaemonSet.

   kubectl apply -f seccomp-block-AF_ALG.yaml

3. Após a implantação, verifique se o arquivo de política foi gravado em cada nó.

   # Verify that the DaemonSet is ready on all nodes.
   kubectl -n kube-system get daemonset ack-cve-2026-31431-mitigate
   # Check the logs to confirm the policy was written. The output should include "Mitigation complete".
   kubectl -n kube-system logs -l app=ack-cve-2026-31431-mitigate --tail=3

2. Configurar um perfil seccomp para um Pod de aplicação

O arquivo de política não é aplicado automaticamente aos Pods. Referencie-o explicitamente no securityContext de cada Pod da carga de trabalho.

1. Configure o perfil seccomp.

   No securityContext do Pod da sua carga de trabalho, defina o tipo de seccompProfile como Localhost e use localhostProfile para especificar o caminho relativo ao diretório raiz seccomp do nó (/var/lib/kubelet/seccomp).

   securityContext:
     seccompProfile:
       type: Localhost
       localhostProfile: profiles/seccomp-block-af_alg.json

2. Após aplicar as alterações, reinicie os Pods da sua carga de trabalho.

3. Monitore os Pods da carga de trabalho para confirmar a execução correta:

   • Se os Pods iniciarem com sucesso, o perfil seccomp estará ativo e a mitigação em vigor.

   • Caso os Pods falhem ao iniciar ou apresentem erros, reverta as alterações imediatamente.