|
 |
bd1529 |
From 8cc497e735104080f6830a8f468b2724ae372990 Mon Sep 17 00:00:00 2001
|
|
|
bd1529 |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
bd1529 |
Date: Wed, 3 Apr 2019 13:11:00 +0200
|
|
|
bd1529 |
Subject: [PATCH] seccomp: rework how the S[UG]ID filter is installed
|
|
|
bd1529 |
|
|
|
bd1529 |
If we know that a syscall is undefined on the given architecture, don't
|
|
|
bd1529 |
even try to add it.
|
|
|
bd1529 |
|
|
|
bd1529 |
Try to install the filter even if some syscalls fail. Also use a helper
|
|
|
bd1529 |
function to make the whole a bit less magic.
|
|
|
bd1529 |
|
|
|
bd1529 |
This allows the S[UG]ID test to pass on arm64.
|
|
|
bd1529 |
|
|
|
bd1529 |
(cherry picked from commit da4dc9a6748797e804b6bc92ad513d509abf581c)
|
|
|
bd1529 |
|
|
|
bd1529 |
Resolves: #1860374
|
|
|
bd1529 |
---
|
|
|
bd1529 |
src/shared/seccomp-util.c | 244 +++++++++++++++++++++-----------------
|
|
|
bd1529 |
1 file changed, 138 insertions(+), 106 deletions(-)
|
|
|
bd1529 |
|
|
|
bd1529 |
diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
|
|
|
bd1529 |
index fd46b9f88d..d91fb4e269 100644
|
|
|
bd1529 |
--- a/src/shared/seccomp-util.c
|
|
|
bd1529 |
+++ b/src/shared/seccomp-util.c
|
|
|
bd1529 |
@@ -1750,9 +1750,139 @@ int seccomp_lock_personality(unsigned long personality) {
|
|
|
bd1529 |
return 0;
|
|
|
bd1529 |
}
|
|
|
bd1529 |
|
|
|
bd1529 |
+static int seccomp_restrict_sxid(scmp_filter_ctx seccomp, mode_t m) {
|
|
|
bd1529 |
+ /* Checks the mode_t parameter of the following system calls:
|
|
|
bd1529 |
+ *
|
|
|
bd1529 |
+ * → chmod() + fchmod() + fchmodat()
|
|
|
bd1529 |
+ * → open() + creat() + openat()
|
|
|
bd1529 |
+ * → mkdir() + mkdirat()
|
|
|
bd1529 |
+ * → mknod() + mknodat()
|
|
|
bd1529 |
+ *
|
|
|
bd1529 |
+ * Returns error if *everything* failed, and 0 otherwise.
|
|
|
bd1529 |
+ */
|
|
|
bd1529 |
+ int r = 0;
|
|
|
bd1529 |
+ bool any = false;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ r = seccomp_rule_add_exact(
|
|
|
bd1529 |
+ seccomp,
|
|
|
bd1529 |
+ SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
+ SCMP_SYS(chmod),
|
|
|
bd1529 |
+ 1,
|
|
|
bd1529 |
+ SCMP_A1(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
+ if (r < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add filter for chmod: %m");
|
|
|
bd1529 |
+ else
|
|
|
bd1529 |
+ any = true;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ r = seccomp_rule_add_exact(
|
|
|
bd1529 |
+ seccomp,
|
|
|
bd1529 |
+ SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
+ SCMP_SYS(fchmod),
|
|
|
bd1529 |
+ 1,
|
|
|
bd1529 |
+ SCMP_A1(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
+ if (r < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add filter for fchmod: %m");
|
|
|
bd1529 |
+ else
|
|
|
bd1529 |
+ any = true;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ r = seccomp_rule_add_exact(
|
|
|
bd1529 |
+ seccomp,
|
|
|
bd1529 |
+ SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
+ SCMP_SYS(fchmodat),
|
|
|
bd1529 |
+ 1,
|
|
|
bd1529 |
+ SCMP_A2(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
+ if (r < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add filter for fchmodat: %m");
|
|
|
bd1529 |
+ else
|
|
|
bd1529 |
+ any = true;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ r = seccomp_rule_add_exact(
|
|
|
bd1529 |
+ seccomp,
|
|
|
bd1529 |
+ SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
+ SCMP_SYS(mkdir),
|
|
|
bd1529 |
+ 1,
|
|
|
bd1529 |
+ SCMP_A1(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
+ if (r < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add filter for mkdir: %m");
|
|
|
bd1529 |
+ else
|
|
|
bd1529 |
+ any = true;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ r = seccomp_rule_add_exact(
|
|
|
bd1529 |
+ seccomp,
|
|
|
bd1529 |
+ SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
+ SCMP_SYS(mkdirat),
|
|
|
bd1529 |
+ 1,
|
|
|
bd1529 |
+ SCMP_A2(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
+ if (r < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add filter for mkdirat: %m");
|
|
|
bd1529 |
+ else
|
|
|
bd1529 |
+ any = true;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ r = seccomp_rule_add_exact(
|
|
|
bd1529 |
+ seccomp,
|
|
|
bd1529 |
+ SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
+ SCMP_SYS(mknod),
|
|
|
bd1529 |
+ 1,
|
|
|
bd1529 |
+ SCMP_A1(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
+ if (r < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add filter for mknod: %m");
|
|
|
bd1529 |
+ else
|
|
|
bd1529 |
+ any = true;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ r = seccomp_rule_add_exact(
|
|
|
bd1529 |
+ seccomp,
|
|
|
bd1529 |
+ SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
+ SCMP_SYS(mknodat),
|
|
|
bd1529 |
+ 1,
|
|
|
bd1529 |
+ SCMP_A2(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
+ if (r < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add filter for mknodat: %m");
|
|
|
bd1529 |
+ else
|
|
|
bd1529 |
+ any = true;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+#if SCMP_SYS(open) > 0
|
|
|
bd1529 |
+ r = seccomp_rule_add_exact(
|
|
|
bd1529 |
+ seccomp,
|
|
|
bd1529 |
+ SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
+ SCMP_SYS(open),
|
|
|
bd1529 |
+ 2,
|
|
|
bd1529 |
+ SCMP_A1(SCMP_CMP_MASKED_EQ, O_CREAT, O_CREAT),
|
|
|
bd1529 |
+ SCMP_A2(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
+ if (r < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add filter for open: %m");
|
|
|
bd1529 |
+ else
|
|
|
bd1529 |
+ any = true;
|
|
|
bd1529 |
+#endif
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ r = seccomp_rule_add_exact(
|
|
|
bd1529 |
+ seccomp,
|
|
|
bd1529 |
+ SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
+ SCMP_SYS(openat),
|
|
|
bd1529 |
+ 2,
|
|
|
bd1529 |
+ SCMP_A2(SCMP_CMP_MASKED_EQ, O_CREAT, O_CREAT),
|
|
|
bd1529 |
+ SCMP_A3(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
+ if (r < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add filter for openat: %m");
|
|
|
bd1529 |
+ else
|
|
|
bd1529 |
+ any = true;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ r = seccomp_rule_add_exact(
|
|
|
bd1529 |
+ seccomp,
|
|
|
bd1529 |
+ SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
+ SCMP_SYS(creat),
|
|
|
bd1529 |
+ 1,
|
|
|
bd1529 |
+ SCMP_A1(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
+ if (r < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add filter for creat: %m");
|
|
|
bd1529 |
+ else
|
|
|
bd1529 |
+ any = true;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ return any ? 0 : r;
|
|
|
bd1529 |
+}
|
|
|
bd1529 |
+
|
|
|
bd1529 |
int seccomp_restrict_suid_sgid(void) {
|
|
|
bd1529 |
uint32_t arch;
|
|
|
bd1529 |
- int r;
|
|
|
bd1529 |
+ int r, k;
|
|
|
bd1529 |
|
|
|
bd1529 |
SECCOMP_FOREACH_LOCAL_ARCH(arch) {
|
|
|
bd1529 |
_cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL;
|
|
|
bd1529 |
@@ -1761,114 +1891,16 @@ int seccomp_restrict_suid_sgid(void) {
|
|
|
bd1529 |
if (r < 0)
|
|
|
bd1529 |
return r;
|
|
|
bd1529 |
|
|
|
bd1529 |
- /* Checks the mode_t parameter of the following system calls:
|
|
|
bd1529 |
- *
|
|
|
bd1529 |
- * → chmod() + fchmod() + fchmodat()
|
|
|
bd1529 |
- * → open() + creat() + openat()
|
|
|
bd1529 |
- * → mkdir() + mkdirat()
|
|
|
bd1529 |
- * → mknod() + mknodat()
|
|
|
bd1529 |
- */
|
|
|
bd1529 |
-
|
|
|
bd1529 |
- for (unsigned bit = 0; bit < 2; bit ++) {
|
|
|
bd1529 |
- /* Block S_ISUID in the first iteration, S_ISGID in the second */
|
|
|
bd1529 |
- mode_t m = bit == 0 ? S_ISUID : S_ISGID;
|
|
|
bd1529 |
-
|
|
|
bd1529 |
- r = seccomp_rule_add_exact(
|
|
|
bd1529 |
- seccomp,
|
|
|
bd1529 |
- SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
- SCMP_SYS(chmod),
|
|
|
bd1529 |
- 1,
|
|
|
bd1529 |
- SCMP_A1(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
- if (r < 0)
|
|
|
bd1529 |
- break;
|
|
|
bd1529 |
-
|
|
|
bd1529 |
- r = seccomp_rule_add_exact(
|
|
|
bd1529 |
- seccomp,
|
|
|
bd1529 |
- SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
- SCMP_SYS(fchmod),
|
|
|
bd1529 |
- 1,
|
|
|
bd1529 |
- SCMP_A1(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
- if (r < 0)
|
|
|
bd1529 |
- break;
|
|
|
bd1529 |
-
|
|
|
bd1529 |
- r = seccomp_rule_add_exact(
|
|
|
bd1529 |
- seccomp,
|
|
|
bd1529 |
- SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
- SCMP_SYS(fchmodat),
|
|
|
bd1529 |
- 1,
|
|
|
bd1529 |
- SCMP_A2(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
- if (r < 0)
|
|
|
bd1529 |
- break;
|
|
|
bd1529 |
-
|
|
|
bd1529 |
- r = seccomp_rule_add_exact(
|
|
|
bd1529 |
- seccomp,
|
|
|
bd1529 |
- SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
- SCMP_SYS(mkdir),
|
|
|
bd1529 |
- 1,
|
|
|
bd1529 |
- SCMP_A1(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
- if (r < 0)
|
|
|
bd1529 |
- break;
|
|
|
bd1529 |
-
|
|
|
bd1529 |
- r = seccomp_rule_add_exact(
|
|
|
bd1529 |
- seccomp,
|
|
|
bd1529 |
- SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
- SCMP_SYS(mkdirat),
|
|
|
bd1529 |
- 1,
|
|
|
bd1529 |
- SCMP_A2(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
- if (r < 0)
|
|
|
bd1529 |
- break;
|
|
|
bd1529 |
-
|
|
|
bd1529 |
- r = seccomp_rule_add_exact(
|
|
|
bd1529 |
- seccomp,
|
|
|
bd1529 |
- SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
- SCMP_SYS(mknod),
|
|
|
bd1529 |
- 1,
|
|
|
bd1529 |
- SCMP_A1(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
- if (r < 0)
|
|
|
bd1529 |
- break;
|
|
|
bd1529 |
-
|
|
|
bd1529 |
- r = seccomp_rule_add_exact(
|
|
|
bd1529 |
- seccomp,
|
|
|
bd1529 |
- SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
- SCMP_SYS(mknodat),
|
|
|
bd1529 |
- 1,
|
|
|
bd1529 |
- SCMP_A2(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
- if (r < 0)
|
|
|
bd1529 |
- break;
|
|
|
bd1529 |
-
|
|
|
bd1529 |
- r = seccomp_rule_add_exact(
|
|
|
bd1529 |
- seccomp,
|
|
|
bd1529 |
- SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
- SCMP_SYS(open),
|
|
|
bd1529 |
- 2,
|
|
|
bd1529 |
- SCMP_A1(SCMP_CMP_MASKED_EQ, O_CREAT, O_CREAT),
|
|
|
bd1529 |
- SCMP_A2(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
- if (r < 0)
|
|
|
bd1529 |
- break;
|
|
|
bd1529 |
+ r = seccomp_restrict_sxid(seccomp, S_ISUID);
|
|
|
bd1529 |
+ if (r < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add suid rule for architecture %s, ignoring: %m", seccomp_arch_to_string(arch));
|
|
|
bd1529 |
|
|
|
bd1529 |
- r = seccomp_rule_add_exact(
|
|
|
bd1529 |
- seccomp,
|
|
|
bd1529 |
- SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
- SCMP_SYS(openat),
|
|
|
bd1529 |
- 2,
|
|
|
bd1529 |
- SCMP_A2(SCMP_CMP_MASKED_EQ, O_CREAT, O_CREAT),
|
|
|
bd1529 |
- SCMP_A3(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
- if (r < 0)
|
|
|
bd1529 |
- break;
|
|
|
bd1529 |
+ k = seccomp_restrict_sxid(seccomp, S_ISGID);
|
|
|
bd1529 |
+ if (k < 0)
|
|
|
bd1529 |
+ log_debug_errno(r, "Failed to add sgid rule for architecture %s, ignoring: %m", seccomp_arch_to_string(arch));
|
|
|
bd1529 |
|
|
|
bd1529 |
- r = seccomp_rule_add_exact(
|
|
|
bd1529 |
- seccomp,
|
|
|
bd1529 |
- SCMP_ACT_ERRNO(EPERM),
|
|
|
bd1529 |
- SCMP_SYS(creat),
|
|
|
bd1529 |
- 1,
|
|
|
bd1529 |
- SCMP_A1(SCMP_CMP_MASKED_EQ, m, m));
|
|
|
bd1529 |
- if (r < 0)
|
|
|
bd1529 |
- break;
|
|
|
bd1529 |
- }
|
|
|
bd1529 |
- if (r < 0) {
|
|
|
bd1529 |
- log_debug_errno(r, "Failed to add suid/sgid rule for architecture %s, skipping: %m", seccomp_arch_to_string(arch));
|
|
|
bd1529 |
+ if (r < 0 && k < 0)
|
|
|
bd1529 |
continue;
|
|
|
bd1529 |
- }
|
|
|
bd1529 |
|
|
|
bd1529 |
r = seccomp_load(seccomp);
|
|
|
bd1529 |
if (IN_SET(r, -EPERM, -EACCES))
|