You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
158 lines
6.7 KiB
158 lines
6.7 KiB
8 months ago
|
From f3c6abebbe4718085fcf17ed3ab0690e379fbb7e Mon Sep 17 00:00:00 2001
|
||
|
|
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
||
|
|
Date: Wed, 19 Aug 2020 17:43:23 +0200
|
||
|
|
Subject: [PATCH] shared: add @known syscall list
|
||
|
|
|
||
|
|
(cherry picked from commit 95aac01259db689dac7d8e5bfafb60e8c70cd734)
|
||
|
|
|
||
|
|
Related: #2040247
|
||
|
|
---
|
||
|
|
man/systemd.exec.xml | 4 ++++
|
||
|
|
src/shared/generate-syscall-list.py | 5 +++++
|
||
|
|
src/shared/meson.build | 11 +++++++++++
|
||
|
|
src/shared/seccomp-util.c | 6 ++++++
|
||
|
|
src/shared/seccomp-util.h | 3 ++-
|
||
|
|
src/test/test-seccomp.c | 19 ++++++++++++-------
|
||
|
|
6 files changed, 40 insertions(+), 8 deletions(-)
|
||
|
|
create mode 100755 src/shared/generate-syscall-list.py
|
||
|
|
|
||
|
|
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
|
||
|
|
index dc88cf9781..b04b4ba552 100644
|
||
|
|
--- a/man/systemd.exec.xml
|
||
|
|
+++ b/man/systemd.exec.xml
|
||
|
|
@@ -1556,6 +1556,10 @@ RestrictNamespaces=~cgroup net</programlisting>
|
||
|
|
<entry>@timer</entry>
|
||
|
|
<entry>System calls for scheduling operations by time (<citerefentry project='man-pages'><refentrytitle>alarm</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>timer_create</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)</entry>
|
||
|
|
</row>
|
||
|
|
+ <row>
|
||
|
|
+ <entry>@known</entry>
|
||
|
|
+ <entry>All system calls defined by the kernel. This list is defined statically in systemd based on a kernel version that was available when this systmed version was released. It will become progressively more out-of-date as the kernel is updated.</entry>
|
||
|
|
+ </row>
|
||
|
|
</tbody>
|
||
|
|
</tgroup>
|
||
|
|
</table>
|
||
|
|
diff --git a/src/shared/generate-syscall-list.py b/src/shared/generate-syscall-list.py
|
||
|
|
new file mode 100755
|
||
|
|
index 0000000000..13a6ae9241
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/src/shared/generate-syscall-list.py
|
||
|
|
@@ -0,0 +1,5 @@
|
||
|
|
+#!/usr/bin/env python
|
||
|
|
+import sys
|
||
|
|
+
|
||
|
|
+for line in open(sys.argv[1]):
|
||
|
|
+ print('"{}\\0"'.format(line.strip()))
|
||
|
|
diff --git a/src/shared/meson.build b/src/shared/meson.build
|
||
|
|
index c9dd0a3a4e..fed08571d1 100644
|
||
|
|
--- a/src/shared/meson.build
|
||
|
|
+++ b/src/shared/meson.build
|
||
|
|
@@ -109,6 +109,16 @@ shared_sources = files('''
|
||
|
|
test_tables_h = files('test-tables.h')
|
||
|
|
shared_sources += [test_tables_h]
|
||
|
|
|
||
|
|
+generate_syscall_list = find_program('generate-syscall-list.py')
|
||
|
|
+fname = 'syscall-list.h'
|
||
|
|
+syscall_list_h = custom_target(
|
||
|
|
+ fname,
|
||
|
|
+ input : 'syscall-names.text',
|
||
|
|
+ output : fname,
|
||
|
|
+ command : [generate_syscall_list,
|
||
|
|
+ '@INPUT@'],
|
||
|
|
+ capture : true)
|
||
|
|
+
|
||
|
|
if conf.get('HAVE_ACL') == 1
|
||
|
|
shared_sources += files('acl-util.c')
|
||
|
|
endif
|
||
|
|
@@ -119,6 +129,7 @@ endif
|
||
|
|
|
||
|
|
if conf.get('HAVE_SECCOMP') == 1
|
||
|
|
shared_sources += files('seccomp-util.c')
|
||
|
|
+ shared_sources += syscall_list_h
|
||
|
|
endif
|
||
|
|
|
||
|
|
if conf.get('HAVE_LIBIPTC') == 1
|
||
|
|
diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
|
||
|
|
index c57c409433..c2b2f2da92 100644
|
||
|
|
--- a/src/shared/seccomp-util.c
|
||
|
|
+++ b/src/shared/seccomp-util.c
|
||
|
|
@@ -855,6 +855,12 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
|
||
|
|
"timerfd_settime\0"
|
||
|
|
"times\0"
|
||
|
|
},
|
||
|
|
+ [SYSCALL_FILTER_SET_KNOWN] = {
|
||
|
|
+ .name = "@known",
|
||
|
|
+ .help = "All known syscalls declared in the kernel",
|
||
|
|
+ .value =
|
||
|
|
+#include "syscall-list.h"
|
||
|
|
+ },
|
||
|
|
};
|
||
|
|
|
||
|
|
const SyscallFilterSet *syscall_filter_set_find(const char *name) {
|
||
|
|
diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h
|
||
|
|
index 602f092255..541ba1e067 100644
|
||
|
|
--- a/src/shared/seccomp-util.h
|
||
|
|
+++ b/src/shared/seccomp-util.h
|
||
|
|
@@ -21,7 +21,7 @@ typedef struct SyscallFilterSet {
|
||
|
|
} SyscallFilterSet;
|
||
|
|
|
||
|
|
enum {
|
||
|
|
- /* Please leave DEFAULT first, but sort the rest alphabetically */
|
||
|
|
+ /* Please leave DEFAULT first and KNOWN last, but sort the rest alphabetically */
|
||
|
|
SYSCALL_FILTER_SET_DEFAULT,
|
||
|
|
SYSCALL_FILTER_SET_AIO,
|
||
|
|
SYSCALL_FILTER_SET_BASIC_IO,
|
||
|
|
@@ -49,6 +49,7 @@ enum {
|
||
|
|
SYSCALL_FILTER_SET_SYNC,
|
||
|
|
SYSCALL_FILTER_SET_SYSTEM_SERVICE,
|
||
|
|
SYSCALL_FILTER_SET_TIMER,
|
||
|
|
+ SYSCALL_FILTER_SET_KNOWN,
|
||
|
|
_SYSCALL_FILTER_SET_MAX
|
||
|
|
};
|
||
|
|
|
||
|
|
diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c
|
||
|
|
index 6ec04c4c55..286f01b5ce 100644
|
||
|
|
--- a/src/test/test-seccomp.c
|
||
|
|
+++ b/src/test/test-seccomp.c
|
||
|
|
@@ -106,8 +106,10 @@ static void test_filter_sets(void) {
|
||
|
|
if (pid == 0) { /* Child? */
|
||
|
|
int fd;
|
||
|
|
|
||
|
|
- /* If we look at the default set (or one that includes it), whitelist instead of blacklist */
|
||
|
|
- if (IN_SET(i, SYSCALL_FILTER_SET_DEFAULT, SYSCALL_FILTER_SET_SYSTEM_SERVICE))
|
||
|
|
+ /* If we look at the default set (or one that includes it), allow-list instead of deny-list */
|
||
|
|
+ if (IN_SET(i, SYSCALL_FILTER_SET_DEFAULT,
|
||
|
|
+ SYSCALL_FILTER_SET_SYSTEM_SERVICE,
|
||
|
|
+ SYSCALL_FILTER_SET_KNOWN))
|
||
|
|
r = seccomp_load_syscall_filter_set(SCMP_ACT_ERRNO(EUCLEAN), syscall_filter_sets + i, SCMP_ACT_ALLOW, true);
|
||
|
|
else
|
||
|
|
r = seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + i, SCMP_ACT_ERRNO(EUCLEAN), true);
|
||
|
|
@@ -639,20 +641,23 @@ static void test_lock_personality(void) {
|
||
|
|
}
|
||
|
|
|
||
|
|
static void test_filter_sets_ordered(void) {
|
||
|
|
- size_t i;
|
||
|
|
-
|
||
|
|
/* Ensure "@default" always remains at the beginning of the list */
|
||
|
|
assert_se(SYSCALL_FILTER_SET_DEFAULT == 0);
|
||
|
|
assert_se(streq(syscall_filter_sets[0].name, "@default"));
|
||
|
|
|
||
|
|
- for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
|
||
|
|
+ /* Ensure "@known" always remains at the end of the list */
|
||
|
|
+ assert_se(SYSCALL_FILTER_SET_KNOWN == _SYSCALL_FILTER_SET_MAX - 1);
|
||
|
|
+ assert_se(streq(syscall_filter_sets[SYSCALL_FILTER_SET_KNOWN].name, "@known"));
|
||
|
|
+
|
||
|
|
+ for (size_t i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
|
||
|
|
const char *k, *p = NULL;
|
||
|
|
|
||
|
|
/* Make sure each group has a description */
|
||
|
|
assert_se(!isempty(syscall_filter_sets[0].help));
|
||
|
|
|
||
|
|
- /* Make sure the groups are ordered alphabetically, except for the first entry */
|
||
|
|
- assert_se(i < 2 || strcmp(syscall_filter_sets[i-1].name, syscall_filter_sets[i].name) < 0);
|
||
|
|
+ /* Make sure the groups are ordered alphabetically, except for the first and last entries */
|
||
|
|
+ assert_se(i < 2 || i == _SYSCALL_FILTER_SET_MAX - 1 ||
|
||
|
|
+ strcmp(syscall_filter_sets[i-1].name, syscall_filter_sets[i].name) < 0);
|
||
|
|
|
||
|
|
NULSTR_FOREACH(k, syscall_filter_sets[i].value) {
|
||
|
|
|