73% of What We Blocked in a Month Was One Syscall Your Sandbox Cannot See

Описание и применение

В большинстве случаев блокировка системного вызова io_uring_setup в sandbox’ах seccomp устраняет критическую уязвимость, позволяющую агентам скрывать операции ввода‑вывода. Это снижает производительность, но повышает безопасность.

Задача

Seccomp-based sandboxes cannot detect io_uring operations, allowing unmonitored I/O that bypasses syscall-level security policies.

Результат

Blocking io_uring_setup eliminates a major blind spot in seccomp sandboxes, ensuring all I/O operations are observable and scored. AI agents lose performance but gain security visibility.

Рабочий процесс

• 1. Run AI agent inside a seccomp sandbox.
• 2. Agent attempts io_uring_setup to create a ring.
• 3. Sandbox allows the syscall, ring is created.
• 4. Agent submits I/O operations via the ring, no further syscalls.
• 5. Seccomp filter cannot see these operations, bypassing security checks.
• 6. Grith intercepts syscalls and denies io_uring_setup before scoring.
• 7. Agent falls back to standard syscalls (openat, connect) which are monitored.

Доказательства

73% of everything we blocked was a single syscall: io_uring_setup.

Источник

Docker blocks the io_uring syscalls in its default seccomp profile as of 25.0.

Источник

grith denies io_uring_setup structurally, before it is ever scored.

Источник