shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-02-27 01:57:35 +03:00
Code

Merge pull request #30291 from keszybz/seccomp-unknown-syscall

Browse Source 
Backwardscompatibly handle syscalls unknown to us or libseccomp
This commit is contained in:
Luca Boccassi 2023-12-02 02:04:24 +00:00 committed by GitHub
commit ebaf2821e6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 31 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/core/exec-invoke.c
View File

@ -5119,7 +5119,7 @@ int exec_invoke(
#endif
#if HAVE_SECCOMP
/* This really should remain as close to the execve() as possible, to make sure our own code is unaffected
/* This really should remain as close to the execve() as possible, to make sure our own code is affected
* by the filter as little as possible. */
r = apply_syscall_filter(context, params, needs_ambient_hack);
if (r < 0) {

2
src/nspawn/nspawn-seccomp.c
View File

@ -169,7 +169,7 @@ static int add_syscall_filters(
/* We have a large filter here, so let's turn on the binary tree mode if possible. */
r = seccomp_attr_set(ctx, SCMP_FLTATR_CTL_OPTIMIZE, 2);
if (r < 0)
return r;
log_warning_errno(r, "Failed to set SCMP_FLTATR_CTL_OPTIMIZE, ignoring: %m");
#endif
return 0;

32
src/shared/seccomp-util.c
View File

@ -1129,7 +1129,9 @@ int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* filter
log_trace("Operating on architecture: %s", seccomp_arch_to_string(arch));
r = seccomp_init_for_arch(&seccomp, arch, default_action);
/* We install ENOSYS as the default action, but it will only apply to syscalls which are not
* in the @known set. */
r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ERRNO(ENOSYS));
if (r < 0)
return r;
@ -1164,6 +1166,30 @@ int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* filter
}
}
NULSTR_FOREACH(name, syscall_filter_sets[SYSCALL_FILTER_SET_KNOWN].value) {
int id;
id = seccomp_syscall_resolve_name(name);
if (id < 0)
continue;
/* Ignore the syscall if it was already handled above */
if (hashmap_contains(filter, INT_TO_PTR(id + 1)))
continue;
r = seccomp_rule_add_exact(seccomp, default_action, id, 0);
if (r < 0 && r != -EDOM) /* EDOM means that the syscall is not available for arch */
return log_debug_errno(r, "Failed to add rule for system call %s() / %d: %m",
name, id);
}
#if (SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR >= 5) || SCMP_VER_MAJOR > 2
/* We have a large filter here, so let's turn on the binary tree mode if possible. */
r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_OPTIMIZE, 2);
if (r < 0)
log_warning_errno(r, "Failed to set SCMP_FLTATR_CTL_OPTIMIZE, ignoring: %m");
#endif
r = seccomp_load(seccomp);
if (ERRNO_IS_NEG_SECCOMP_FATAL(r))
return r;
@ -1223,7 +1249,7 @@ int seccomp_parse_syscall_filter(
return -EINVAL;
log_syntax(unit, FLAGS_SET(flags, SECCOMP_PARSE_LOG) ? LOG_WARNING : LOG_DEBUG, filename, line, 0,
"Failed to parse system call, ignoring: %s", name);
"System call %s is not known, ignoring.", name);
return 0;
}
@ -1981,7 +2007,7 @@ int seccomp_filter_set_add(Hashmap *filter, bool add, const SyscallFilterSet *se
id = seccomp_syscall_resolve_name(i);
if (id == __NR_SCMP_ERROR) {
log_debug("Couldn't resolve system call, ignoring: %s", i);
log_debug("System call %s is not known, ignoring.", i);
continue;
}