mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-08-22 06:51:39 +00:00
Code Issues Releases Wiki Activity

Merge pull request #4047 from brauner/2021-12-10.fixes

Browse Source 
seccomp: only guard seccomp notify behind HAVE_DECL_SECCOMP_NOTIFY_FD
This commit is contained in:
Stéphane Graber 2021-12-10 12:14:11 -05:00 committed by GitHub
commit 2ac414d567
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/lxc/api_extensions.h
View File

@ -27,9 +27,9 @@ static char *api_extensions[] = {
"cgroup_relative",
"mount_injection_file",
"seccomp_allow_nesting",
#ifdef HAVE_SECCOMP_NOTIFY
#ifdef HAVE_DECL_SECCOMP_NOTIFY_FD
"seccomp_notify",
#endif /* HAVE_SECCOMP_NOTIFY */
#endif /* HAVE_DECL_SECCOMP_NOTIFY_FD */
"network_veth_routes",
"network_ipvlan",
"network_l2proxy",
@ -44,10 +44,10 @@ static char *api_extensions[] = {
"time_namespace",
"seccomp_allow_deny_syntax",
"devpts_fd",
#ifdef HAVE_SECCOMP_NOTIFY
#ifdef HAVE_DECL_SECCOMP_NOTIFY_FD
"seccomp_notify_fd_active",
"seccomp_proxy_send_notify_fd",
#endif /* HAVE_SECCOMP_NOTIFY */
#endif /* HAVE_DECL_SECCOMP_NOTIFY_FD */
"idmapped_mounts",
"idmapped_mounts_v2",
"core_scheduling",

8
src/lxc/commands.c
View File

@ -701,7 +701,7 @@ static int lxc_cmd_get_devpts_fd_callback(int fd, struct lxc_cmd_req *req,
int lxc_cmd_get_seccomp_notify_fd(const char *name, const char *lxcpath)
{
#ifdef HAVE_SECCOMP_NOTIFY
#if HAVE_DECL_SECCOMP_NOTIFY_FD
bool stopped = false;
int fd;
ssize_t ret;
@ -732,7 +732,7 @@ static int lxc_cmd_get_seccomp_notify_fd_callback(int fd, struct lxc_cmd_req *re
struct lxc_handler *handler,
struct lxc_async_descr *descr)
{
#ifdef HAVE_SECCOMP_NOTIFY
#if HAVE_DECL_SECCOMP_NOTIFY_FD
struct lxc_cmd_rsp rsp = {
.ret = -EBADF,
};
@ -1543,7 +1543,7 @@ int lxc_cmd_seccomp_notify_add_listener(const char *name, const char *lxcpath,
/* unused */ unsigned int flags)
{
#ifdef HAVE_SECCOMP_NOTIFY
#if HAVE_DECL_SECCOMP_NOTIFY_FD
bool stopped = false;
ssize_t ret;
struct lxc_cmd_rr cmd;
@ -1568,7 +1568,7 @@ static int lxc_cmd_seccomp_notify_add_listener_callback(int fd,
{
struct lxc_cmd_rsp rsp = {0};
#ifdef HAVE_SECCOMP_NOTIFY
#if HAVE_DECL_SECCOMP_NOTIFY_FD
int ret;
__do_close int recv_fd = -EBADF;

12
src/lxc/confile.c
View File

@ -1204,7 +1204,7 @@ static int set_config_seccomp_allow_nesting(const char *key, const char *value,
static int set_config_seccomp_notify_cookie(const char *key, const char *value,
struct lxc_conf *lxc_conf, void *data)
{
#ifdef HAVE_SECCOMP_NOTIFY
#if HAVE_DECL_SECCOMP_NOTIFY_FD
return set_config_string_item(&lxc_conf->seccomp.notifier.cookie, value);
#else
return ret_errno(ENOSYS);
@ -1214,7 +1214,7 @@ static int set_config_seccomp_notify_cookie(const char *key, const char *value,
static int set_config_seccomp_notify_proxy(const char *key, const char *value,
struct lxc_conf *lxc_conf, void *data)
{
#ifdef HAVE_SECCOMP_NOTIFY
#if HAVE_DECL_SECCOMP_NOTIFY_FD
const char *offset;
if (lxc_config_value_empty(value))
@ -4399,7 +4399,7 @@ static int get_config_seccomp_allow_nesting(const char *key, char *retv,
static int get_config_seccomp_notify_cookie(const char *key, char *retv, int inlen,
struct lxc_conf *c, void *data)
{
#ifdef HAVE_SECCOMP_NOTIFY
#if HAVE_DECL_SECCOMP_NOTIFY_FD
return lxc_get_conf_str(retv, inlen, c->seccomp.notifier.cookie);
#else
return ret_errno(ENOSYS);
@ -4409,7 +4409,7 @@ static int get_config_seccomp_notify_cookie(const char *key, char *retv, int inl
static int get_config_seccomp_notify_proxy(const char *key, char *retv, int inlen,
struct lxc_conf *c, void *data)
{
#ifdef HAVE_SECCOMP_NOTIFY
#if HAVE_DECL_SECCOMP_NOTIFY_FD
return lxc_get_conf_str(retv, inlen,
(c->seccomp.notifier.proxy_addr.sun_path[0]) == '/'
? &c->seccomp.notifier.proxy_addr.sun_path[0]
@ -5142,7 +5142,7 @@ static inline int clr_config_seccomp_allow_nesting(const char *key,
static inline int clr_config_seccomp_notify_cookie(const char *key,
struct lxc_conf *c, void *data)
{
#ifdef HAVE_SECCOMP_NOTIFY
#if HAVE_DECL_SECCOMP_NOTIFY_FD
free_disarm(c->seccomp.notifier.cookie);
return 0;
#else
@ -5153,7 +5153,7 @@ static inline int clr_config_seccomp_notify_cookie(const char *key,
static inline int clr_config_seccomp_notify_proxy(const char *key,
struct lxc_conf *c, void *data)
{
#ifdef HAVE_SECCOMP_NOTIFY
#if HAVE_DECL_SECCOMP_NOTIFY_FD
memset(&c->seccomp.notifier.proxy_addr, 0,
sizeof(c->seccomp.notifier.proxy_addr));
return 0;

4
src/lxc/lxcseccomp.h
View File

@ -6,10 +6,12 @@
#include "config.h"
#include <errno.h>
#ifdef HAVE_SECCOMP
#include <linux/seccomp.h>
#include <seccomp.h>
#endif
#if HAVE_DECL_SECCOMP_NOTIFY_FD
#include <sys/socket.h>
#include <sys/un.h>
@ -60,8 +62,6 @@ struct seccomp_notify {
char *cookie;
};
#define HAVE_SECCOMP_NOTIFY 1
#endif /* HAVE_DECL_SECCOMP_NOTIFY_FD */
struct lxc_seccomp {