|
 |
b7dd4d |
From 65d64ba146c30a5f205b650381f331fd8db2eb22 Mon Sep 17 00:00:00 2001
|
|
|
b7dd4d |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
b7dd4d |
Date: Fri, 21 Aug 2020 17:23:48 +0200
|
|
|
b7dd4d |
Subject: [PATCH] nspawn: return ENOSYS by default, EPERM for "known" calls
|
|
|
b7dd4d |
|
|
|
b7dd4d |
(cherry picked from commit 3573e032f26724949e86626eace058d006b8bf70)
|
|
|
b7dd4d |
|
|
|
b7dd4d |
Resolves: #2040247
|
|
|
b7dd4d |
---
|
|
|
b7dd4d |
src/nspawn/nspawn-seccomp.c | 20 +++++++++++++++-----
|
|
|
b7dd4d |
1 file changed, 15 insertions(+), 5 deletions(-)
|
|
|
b7dd4d |
|
|
|
b7dd4d |
diff --git a/src/nspawn/nspawn-seccomp.c b/src/nspawn/nspawn-seccomp.c
|
|
|
b7dd4d |
index 2b4a65e875..563cda140e 100644
|
|
|
b7dd4d |
--- a/src/nspawn/nspawn-seccomp.c
|
|
|
b7dd4d |
+++ b/src/nspawn/nspawn-seccomp.c
|
|
|
b7dd4d |
@@ -20,7 +20,7 @@
|
|
|
b7dd4d |
|
|
|
b7dd4d |
#if HAVE_SECCOMP
|
|
|
b7dd4d |
|
|
|
b7dd4d |
-static int seccomp_add_default_syscall_filter(
|
|
|
b7dd4d |
+static int add_syscall_filters(
|
|
|
b7dd4d |
scmp_filter_ctx ctx,
|
|
|
b7dd4d |
uint32_t arch,
|
|
|
b7dd4d |
uint64_t cap_list_retain,
|
|
|
b7dd4d |
@@ -140,6 +140,7 @@ static int seccomp_add_default_syscall_filter(
|
|
|
b7dd4d |
*/
|
|
|
b7dd4d |
};
|
|
|
b7dd4d |
|
|
|
b7dd4d |
+ _cleanup_strv_free_ char **added = NULL;
|
|
|
b7dd4d |
int r;
|
|
|
b7dd4d |
size_t i;
|
|
|
b7dd4d |
char **p;
|
|
|
b7dd4d |
@@ -153,18 +154,25 @@ static int seccomp_add_default_syscall_filter(
|
|
|
b7dd4d |
SCMP_ACT_ALLOW,
|
|
|
b7dd4d |
syscall_blacklist,
|
|
|
b7dd4d |
false,
|
|
|
b7dd4d |
- NULL);
|
|
|
b7dd4d |
+ &added);
|
|
|
b7dd4d |
if (r < 0)
|
|
|
b7dd4d |
return log_error_errno(r, "Failed to add syscall filter item %s: %m", whitelist[i].name);
|
|
|
b7dd4d |
}
|
|
|
b7dd4d |
|
|
|
b7dd4d |
STRV_FOREACH(p, syscall_whitelist) {
|
|
|
b7dd4d |
- r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_blacklist, false, NULL);
|
|
|
b7dd4d |
+ r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_blacklist, true, &added);
|
|
|
b7dd4d |
if (r < 0)
|
|
|
b7dd4d |
log_warning_errno(r, "Failed to add rule for system call %s on %s, ignoring: %m",
|
|
|
b7dd4d |
*p, seccomp_arch_to_string(arch));
|
|
|
b7dd4d |
}
|
|
|
b7dd4d |
|
|
|
b7dd4d |
+ /* The default action is ENOSYS. Respond with EPERM to all other "known" but not allow-listed
|
|
|
b7dd4d |
+ * syscalls. */
|
|
|
b7dd4d |
+ r = seccomp_add_syscall_filter_item(ctx, "@known", SCMP_ACT_ERRNO(EPERM), added, true, NULL);
|
|
|
b7dd4d |
+ if (r < 0)
|
|
|
b7dd4d |
+ log_warning_errno(r, "Failed to add rule for @known set on %s, ignoring: %m",
|
|
|
b7dd4d |
+ seccomp_arch_to_string(arch));
|
|
|
b7dd4d |
+
|
|
|
b7dd4d |
return 0;
|
|
|
b7dd4d |
}
|
|
|
b7dd4d |
|
|
|
b7dd4d |
@@ -182,11 +190,13 @@ int setup_seccomp(uint64_t cap_list_retain, char **syscall_whitelist, char **sys
|
|
|
b7dd4d |
|
|
|
b7dd4d |
log_debug("Applying whitelist on architecture: %s", seccomp_arch_to_string(arch));
|
|
|
b7dd4d |
|
|
|
b7dd4d |
- r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ERRNO(EPERM));
|
|
|
b7dd4d |
+ /* We install ENOSYS as the default action, but it will only apply to syscalls which are not
|
|
|
b7dd4d |
+ * in the @known set, see above. */
|
|
|
b7dd4d |
+ r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ERRNO(ENOSYS));
|
|
|
b7dd4d |
if (r < 0)
|
|
|
b7dd4d |
return log_error_errno(r, "Failed to allocate seccomp object: %m");
|
|
|
b7dd4d |
|
|
|
b7dd4d |
- r = seccomp_add_default_syscall_filter(seccomp, arch, cap_list_retain, syscall_whitelist, syscall_blacklist);
|
|
|
b7dd4d |
+ r = add_syscall_filters(seccomp, arch, cap_list_retain, syscall_whitelist, syscall_blacklist);
|
|
|
b7dd4d |
if (r < 0)
|
|
|
b7dd4d |
return r;
|
|
|
b7dd4d |
|