You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
78 lines
3.4 KiB
78 lines
3.4 KiB
From 65d64ba146c30a5f205b650381f331fd8db2eb22 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
Date: Fri, 21 Aug 2020 17:23:48 +0200
|
|
Subject: [PATCH] nspawn: return ENOSYS by default, EPERM for "known" calls
|
|
|
|
(cherry picked from commit 3573e032f26724949e86626eace058d006b8bf70)
|
|
|
|
Resolves: #2040247
|
|
---
|
|
src/nspawn/nspawn-seccomp.c | 20 +++++++++++++++-----
|
|
1 file changed, 15 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/src/nspawn/nspawn-seccomp.c b/src/nspawn/nspawn-seccomp.c
|
|
index 2b4a65e875..563cda140e 100644
|
|
--- a/src/nspawn/nspawn-seccomp.c
|
|
+++ b/src/nspawn/nspawn-seccomp.c
|
|
@@ -20,7 +20,7 @@
|
|
|
|
#if HAVE_SECCOMP
|
|
|
|
-static int seccomp_add_default_syscall_filter(
|
|
+static int add_syscall_filters(
|
|
scmp_filter_ctx ctx,
|
|
uint32_t arch,
|
|
uint64_t cap_list_retain,
|
|
@@ -140,6 +140,7 @@ static int seccomp_add_default_syscall_filter(
|
|
*/
|
|
};
|
|
|
|
+ _cleanup_strv_free_ char **added = NULL;
|
|
int r;
|
|
size_t i;
|
|
char **p;
|
|
@@ -153,18 +154,25 @@ static int seccomp_add_default_syscall_filter(
|
|
SCMP_ACT_ALLOW,
|
|
syscall_blacklist,
|
|
false,
|
|
- NULL);
|
|
+ &added);
|
|
if (r < 0)
|
|
return log_error_errno(r, "Failed to add syscall filter item %s: %m", whitelist[i].name);
|
|
}
|
|
|
|
STRV_FOREACH(p, syscall_whitelist) {
|
|
- r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_blacklist, false, NULL);
|
|
+ r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_blacklist, true, &added);
|
|
if (r < 0)
|
|
log_warning_errno(r, "Failed to add rule for system call %s on %s, ignoring: %m",
|
|
*p, seccomp_arch_to_string(arch));
|
|
}
|
|
|
|
+ /* The default action is ENOSYS. Respond with EPERM to all other "known" but not allow-listed
|
|
+ * syscalls. */
|
|
+ r = seccomp_add_syscall_filter_item(ctx, "@known", SCMP_ACT_ERRNO(EPERM), added, true, NULL);
|
|
+ if (r < 0)
|
|
+ log_warning_errno(r, "Failed to add rule for @known set on %s, ignoring: %m",
|
|
+ seccomp_arch_to_string(arch));
|
|
+
|
|
return 0;
|
|
}
|
|
|
|
@@ -182,11 +190,13 @@ int setup_seccomp(uint64_t cap_list_retain, char **syscall_whitelist, char **sys
|
|
|
|
log_debug("Applying whitelist on architecture: %s", seccomp_arch_to_string(arch));
|
|
|
|
- r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ERRNO(EPERM));
|
|
+ /* We install ENOSYS as the default action, but it will only apply to syscalls which are not
|
|
+ * in the @known set, see above. */
|
|
+ r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ERRNO(ENOSYS));
|
|
if (r < 0)
|
|
return log_error_errno(r, "Failed to allocate seccomp object: %m");
|
|
|
|
- r = seccomp_add_default_syscall_filter(seccomp, arch, cap_list_retain, syscall_whitelist, syscall_blacklist);
|
|
+ r = add_syscall_filters(seccomp, arch, cap_list_retain, syscall_whitelist, syscall_blacklist);
|
|
if (r < 0)
|
|
return r;
|
|
|