mirror of
https://github.com/systemd/systemd-stable.git
synced 2025-03-08 20:58:20 +03:00
nspawn: allow sched_rr_get_interval_time64 through seccomp filter
We only allow a selected subset of syscalls from nspawn containers and don't list any time64 variants (needed for 32-bit arches when built using TIME_BITS=64, which is relatively new). We allow sched_rr_get_interval which cpython's test suite makes use of, but we don't allow sched_rr_get_interval_time64. The test failures when run in an arm32 nspawn container on an arm64 host were as follows: ``` ====================================================================== ERROR: test_sched_rr_get_interval (test.test_posix.PosixTester.test_sched_rr_get_interval) ---------------------------------------------------------------------- Traceback (most recent call last): File "/var/tmp/portage/dev-lang/python-3.11.0_p1/work/Python-3.11.0/Lib/test/test_posix.py", line 1180, in test_sched_rr_get_interval interval = posix.sched_rr_get_interval(0) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ PermissionError: [Errno 1] Operation not permitted ``` Then strace showed: ``` sched_rr_get_interval_time64(0, 0xffbbd4a0) = -1 EPERM (Operation not permitted) ``` This appears to be the only time64 syscall that isn't already included one of the sets listed in nspawn-seccomp.c that has a non-time64 variant. Checked over each of the time64 syscalls known to systemd and verified that none of the others had a non-time64-variant whitelisted in nspawn other than sched_rr_get_interval. Bug: https://bugs.gentoo.org/880131 (cherry picked from commit b9e7f22c2d80930cad36ae53e66e42a2996dca4a) (cherry picked from commit 2b52748d45dd9d30e3ffb61a9f724e3b701975e4)
This commit is contained in:
parent
5e5cbc3daa
commit
de80b160ed
@ -88,6 +88,7 @@ static int add_syscall_filters(
|
||||
{ 0, "sched_getparam" },
|
||||
{ 0, "sched_getscheduler" },
|
||||
{ 0, "sched_rr_get_interval" },
|
||||
{ 0, "sched_rr_get_interval_time64" },
|
||||
{ 0, "sched_yield" },
|
||||
{ 0, "seccomp" },
|
||||
{ 0, "sendfile" },
|
||||
|
Loading…
x
Reference in New Issue
Block a user