mir/criu
2
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu synced 2025-08-31 14:25:49 +00:00
Code Issues Releases Wiki Activity

seccomp: add initial support for SECCOMP_MODE_STRICT

Browse Source 
Unfortunately, SECCOMP_MODE_FILTER is not currently exposed to userspace,
so we can't checkpoint that. In any case, this is what we need to do for
SECCOMP_MODE_STRICT, so let's do it.

This patch works by first disabling seccomp for any processes who are going
to have seccomp filters restored, then restoring the process (including the
seccomp filters), and finally resuming the seccomp filters before detaching
from the process.

v2 changes:

* update for kernel patch v2
* use protobuf enum for seccomp type
* don't parse /proc/pid/status twice

v3 changes:

* get rid of extra CR_STAGE_SECCOMP_SUSPEND stage
* only suspend seccomp in finalize_restore(), just before the unmap
* restore the (same) seccomp state in threads too; also add a note about
  how this is slightly wrong, and that we should at least check for a
  mismatch

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This commit is contained in:
Tycho Andersen
2015-06-18 11:59:16 -06:00
committed by Pavel Emelyanov
parent bf4243e303
commit 0d8aec0c3a
14 changed files with 180 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
proc_parse.c
View File

@@ -9,6 +9,7 @@
#include <string.h>
#include <ctype.h>
#include <linux/fs.h>
#include <linux/seccomp.h>
#include "asm/types.h"
#include "list.h"
@@ -779,7 +780,7 @@ int parse_pid_status(pid_t pid, struct proc_status_creds *cr)
if (bfdopenr(&f))
return -1;
while (done < 8) {
while (done < 9) {
str = breadline(&f);
if (str == NULL)
break;
@@ -840,9 +841,22 @@ int parse_pid_status(pid_t pid, struct proc_status_creds *cr)
done++;
}
if (!strncmp(str, "Seccomp:", 8)) {
if (sscanf(str + 9, "%d", &cr->seccomp_mode) != 1) {
goto err_parse;
}
if (cr->seccomp_mode == SECCOMP_MODE_FILTER) {
pr_err("SECCOMP_MODE_FILTER not currently supported\n");
goto err_parse;
}
done++;
}
}
if (done == 8)
if (done == 9)
ret = 0;
err_parse: