diff --git a/pkg/sentry/socket/hostinet/socket_unsafe.go b/pkg/sentry/socket/hostinet/socket_unsafe.go
index 587f479eb..d19a58736 100644
--- a/pkg/sentry/socket/hostinet/socket_unsafe.go
+++ b/pkg/sentry/socket/hostinet/socket_unsafe.go
@@ -67,7 +67,7 @@ func ioctl(ctx context.Context, fd int, io usermem.IO, args arch.SyscallArgument
 			AddressSpaceActive: true,
 		})
 		return 0, err
-	case unix.SIOCGIFFLAGS, unix.SIOCGIFCONF:
+	case unix.SIOCGIFFLAGS:
 		cc := &usermem.IOCopyContext{
 			Ctx: ctx,
 			IO:  io,
@@ -84,6 +84,24 @@ func ioctl(ctx context.Context, fd int, io usermem.IO, args arch.SyscallArgument
 		}
 		_, err := ifr.CopyOut(cc, args[2].Pointer())
 		return 0, err
+	case unix.SIOCGIFCONF:
+		cc := &usermem.IOCopyContext{
+			Ctx: ctx,
+			IO:  io,
+			Opts: usermem.IOOpts{
+				AddressSpaceActive: true,
+			},
+		}
+		var ifc linux.IFConf
+		if _, err := ifc.CopyIn(cc, args[2].Pointer()); err != nil {
+			return 0, err
+		}
+		// TODO(b/209503078): Check ifc.Ptr range is in untrusted range.
+		if _, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), cmd, uintptr(unsafe.Pointer(&ifc))); errno != 0 {
+			return 0, translateIOSyscallError(errno)
+		}
+		_, err := ifc.CopyOut(cc, args[2].Pointer())
+		return 0, err
 	default:
 		return 0, linuxerr.ENOTTY
 	}