|
 |
b677e7 |
From 3cf73fa4599116da350a0100378e749bbcbcad37 Mon Sep 17 00:00:00 2001
|
|
|
b677e7 |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
b677e7 |
Date: Thu, 26 Nov 2020 11:23:54 +0100
|
|
|
b677e7 |
Subject: [PATCH] shared/seccomp-util: address family filtering is broken on
|
|
|
b677e7 |
ppc
|
|
|
b677e7 |
|
|
|
b677e7 |
This reverts the gist of da1921a5c396547261c8c7fcd94173346eb3b718 and
|
|
|
b677e7 |
0d9fca76bb69e162265b2d25cb79f1890c0da31b (for ppc).
|
|
|
b677e7 |
|
|
|
b677e7 |
Quoting #17559:
|
|
|
b677e7 |
> libseccomp 2.5 added socket syscall multiplexing on ppc64(el):
|
|
|
b677e7 |
> https://github.com/seccomp/libseccomp/pull/229
|
|
|
b677e7 |
>
|
|
|
b677e7 |
> Like with i386, s390 and s390x this breaks socket argument filtering, so
|
|
|
b677e7 |
> RestrictAddressFamilies doesn't work.
|
|
|
b677e7 |
>
|
|
|
b677e7 |
> This causes the unit test to fail:
|
|
|
b677e7 |
> /* test_restrict_address_families */
|
|
|
b677e7 |
> Operating on architecture: ppc
|
|
|
b677e7 |
> Failed to install socket family rules for architecture ppc, skipping: Operation canceled
|
|
|
b677e7 |
> Operating on architecture: ppc64
|
|
|
b677e7 |
> Failed to add socket() rule for architecture ppc64, skipping: Invalid argument
|
|
|
b677e7 |
> Operating on architecture: ppc64-le
|
|
|
b677e7 |
> Failed to add socket() rule for architecture ppc64-le, skipping: Invalid argument
|
|
|
b677e7 |
> Assertion 'fd < 0' failed at src/test/test-seccomp.c:424, function test_restrict_address_families(). Aborting.
|
|
|
b677e7 |
>
|
|
|
b677e7 |
> The socket filters can't be added so `socket(AF_UNIX, SOCK_DGRAM, 0);` still
|
|
|
b677e7 |
> works, triggering the assertion.
|
|
|
b677e7 |
|
|
|
b677e7 |
Fixes #17559.
|
|
|
b677e7 |
|
|
|
b677e7 |
(cherry picked from commit d5923e38bc0e6cf9d7620ed5f1f8606fe7fe1168)
|
|
|
b677e7 |
|
|
|
b677e7 |
Resolves: #1982650
|
|
|
b677e7 |
---
|
|
|
b677e7 |
src/shared/seccomp-util.c | 6 +++---
|
|
|
b677e7 |
src/test/test-seccomp.c | 2 +-
|
|
|
b677e7 |
2 files changed, 4 insertions(+), 4 deletions(-)
|
|
|
b677e7 |
|
|
|
b677e7 |
diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
|
|
|
b677e7 |
index e903512d45..c57c409433 100644
|
|
|
b677e7 |
--- a/src/shared/seccomp-util.c
|
|
|
b677e7 |
+++ b/src/shared/seccomp-util.c
|
|
|
b677e7 |
@@ -1251,9 +1251,6 @@ int seccomp_restrict_address_families(Set *address_families, bool whitelist) {
|
|
|
b677e7 |
case SCMP_ARCH_X32:
|
|
|
b677e7 |
case SCMP_ARCH_ARM:
|
|
|
b677e7 |
case SCMP_ARCH_AARCH64:
|
|
|
b677e7 |
- case SCMP_ARCH_PPC:
|
|
|
b677e7 |
- case SCMP_ARCH_PPC64:
|
|
|
b677e7 |
- case SCMP_ARCH_PPC64LE:
|
|
|
b677e7 |
case SCMP_ARCH_MIPSEL64N32:
|
|
|
b677e7 |
case SCMP_ARCH_MIPS64N32:
|
|
|
b677e7 |
case SCMP_ARCH_MIPSEL64:
|
|
|
b677e7 |
@@ -1267,6 +1264,9 @@ int seccomp_restrict_address_families(Set *address_families, bool whitelist) {
|
|
|
b677e7 |
case SCMP_ARCH_X86:
|
|
|
b677e7 |
case SCMP_ARCH_MIPSEL:
|
|
|
b677e7 |
case SCMP_ARCH_MIPS:
|
|
|
b677e7 |
+ case SCMP_ARCH_PPC:
|
|
|
b677e7 |
+ case SCMP_ARCH_PPC64:
|
|
|
b677e7 |
+ case SCMP_ARCH_PPC64LE:
|
|
|
b677e7 |
default:
|
|
|
b677e7 |
/* These we either know we don't support (i.e. are the ones that do use socketcall()), or we
|
|
|
b677e7 |
* don't know */
|
|
|
b677e7 |
diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c
|
|
|
b677e7 |
index 009a2e1922..5eb1c78b8b 100644
|
|
|
b677e7 |
--- a/src/test/test-seccomp.c
|
|
|
b677e7 |
+++ b/src/test/test-seccomp.c
|
|
|
b677e7 |
@@ -25,7 +25,7 @@
|
|
|
b677e7 |
#include "util.h"
|
|
|
b677e7 |
#include "virt.h"
|
|
|
b677e7 |
|
|
|
b677e7 |
-#if SCMP_SYS(socket) < 0 || defined(__i386__) || defined(__s390x__) || defined(__s390__)
|
|
|
b677e7 |
+#if SCMP_SYS(socket) < 0 || defined(__i386__) || defined(__s390x__) || defined(__s390__) || defined(__powerpc64__) || defined(__powerpc__)
|
|
|
b677e7 |
/* On these archs, socket() is implemented via the socketcall() syscall multiplexer,
|
|
|
b677e7 |
* and we can't restrict it hence via seccomp. */
|
|
|
b677e7 |
# define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 1
|