mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-08-22 14:01:33 +00:00
Code Issues Releases Wiki Activity

Merge pull request #4047 from brauner/2021-12-10.fixes

Browse Source 
seccomp: only guard seccomp notify behind HAVE_DECL_SECCOMP_NOTIFY_FD
This commit is contained in:
Stéphane Graber 2021-12-10 12:14:11 -05:00 committed by GitHub
commit 2ac414d567
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/lxc/api_extensions.h
View File

@ -27,9 +27,9 @@ static char *api_extensions[] = {
"cgroup_relative", "cgroup_relative",
"mount_injection_file", "mount_injection_file",
"seccomp_allow_nesting", "seccomp_allow_nesting",
#ifdef HAVE_SECCOMP_NOTIFY #ifdef HAVE_DECL_SECCOMP_NOTIFY_FD
"seccomp_notify", "seccomp_notify",
#endif /* HAVE_SECCOMP_NOTIFY */ #endif /* HAVE_DECL_SECCOMP_NOTIFY_FD */
"network_veth_routes", "network_veth_routes",
"network_ipvlan", "network_ipvlan",
"network_l2proxy", "network_l2proxy",
@ -44,10 +44,10 @@ static char *api_extensions[] = {
"time_namespace", "time_namespace",
"seccomp_allow_deny_syntax", "seccomp_allow_deny_syntax",
"devpts_fd", "devpts_fd",
#ifdef HAVE_SECCOMP_NOTIFY #ifdef HAVE_DECL_SECCOMP_NOTIFY_FD
"seccomp_notify_fd_active", "seccomp_notify_fd_active",
"seccomp_proxy_send_notify_fd", "seccomp_proxy_send_notify_fd",
#endif /* HAVE_SECCOMP_NOTIFY */ #endif /* HAVE_DECL_SECCOMP_NOTIFY_FD */
"idmapped_mounts", "idmapped_mounts",
"idmapped_mounts_v2", "idmapped_mounts_v2",
"core_scheduling", "core_scheduling",

8
src/lxc/commands.c
View File

@ -701,7 +701,7 @@ static int lxc_cmd_get_devpts_fd_callback(int fd, struct lxc_cmd_req *req,
int lxc_cmd_get_seccomp_notify_fd(const char *name, const char *lxcpath) int lxc_cmd_get_seccomp_notify_fd(const char *name, const char *lxcpath)
{ {
#ifdef HAVE_SECCOMP_NOTIFY #if HAVE_DECL_SECCOMP_NOTIFY_FD
bool stopped = false; bool stopped = false;
int fd; int fd;
ssize_t ret; ssize_t ret;
@ -732,7 +732,7 @@ static int lxc_cmd_get_seccomp_notify_fd_callback(int fd, struct lxc_cmd_req *re
struct lxc_handler *handler, struct lxc_handler *handler,
struct lxc_async_descr *descr) struct lxc_async_descr *descr)
{ {
#ifdef HAVE_SECCOMP_NOTIFY #if HAVE_DECL_SECCOMP_NOTIFY_FD
struct lxc_cmd_rsp rsp = { struct lxc_cmd_rsp rsp = {
.ret = -EBADF, .ret = -EBADF,
}; };
@ -1543,7 +1543,7 @@ int lxc_cmd_seccomp_notify_add_listener(const char *name, const char *lxcpath,
/* unused */ unsigned int flags) /* unused */ unsigned int flags)
{ {
#ifdef HAVE_SECCOMP_NOTIFY #if HAVE_DECL_SECCOMP_NOTIFY_FD
bool stopped = false; bool stopped = false;
ssize_t ret; ssize_t ret;
struct lxc_cmd_rr cmd; struct lxc_cmd_rr cmd;
@ -1568,7 +1568,7 @@ static int lxc_cmd_seccomp_notify_add_listener_callback(int fd,
{ {
struct lxc_cmd_rsp rsp = {0}; struct lxc_cmd_rsp rsp = {0};
#ifdef HAVE_SECCOMP_NOTIFY #if HAVE_DECL_SECCOMP_NOTIFY_FD
int ret; int ret;
__do_close int recv_fd = -EBADF; __do_close int recv_fd = -EBADF;

12
src/lxc/confile.c
View File

@ -1204,7 +1204,7 @@ static int set_config_seccomp_allow_nesting(const char *key, const char *value,
static int set_config_seccomp_notify_cookie(const char *key, const char *value, static int set_config_seccomp_notify_cookie(const char *key, const char *value,
struct lxc_conf *lxc_conf, void *data) struct lxc_conf *lxc_conf, void *data)
{ {
#ifdef HAVE_SECCOMP_NOTIFY #if HAVE_DECL_SECCOMP_NOTIFY_FD
return set_config_string_item(&lxc_conf->seccomp.notifier.cookie, value); return set_config_string_item(&lxc_conf->seccomp.notifier.cookie, value);
#else #else
return ret_errno(ENOSYS); return ret_errno(ENOSYS);
@ -1214,7 +1214,7 @@ static int set_config_seccomp_notify_cookie(const char *key, const char *value,
static int set_config_seccomp_notify_proxy(const char *key, const char *value, static int set_config_seccomp_notify_proxy(const char *key, const char *value,
struct lxc_conf *lxc_conf, void *data) struct lxc_conf *lxc_conf, void *data)
{ {
#ifdef HAVE_SECCOMP_NOTIFY #if HAVE_DECL_SECCOMP_NOTIFY_FD
const char *offset; const char *offset;
if (lxc_config_value_empty(value)) if (lxc_config_value_empty(value))
@ -4399,7 +4399,7 @@ static int get_config_seccomp_allow_nesting(const char *key, char *retv,
static int get_config_seccomp_notify_cookie(const char *key, char *retv, int inlen, static int get_config_seccomp_notify_cookie(const char *key, char *retv, int inlen,
struct lxc_conf *c, void *data) struct lxc_conf *c, void *data)
{ {
#ifdef HAVE_SECCOMP_NOTIFY #if HAVE_DECL_SECCOMP_NOTIFY_FD
return lxc_get_conf_str(retv, inlen, c->seccomp.notifier.cookie); return lxc_get_conf_str(retv, inlen, c->seccomp.notifier.cookie);
#else #else
return ret_errno(ENOSYS); return ret_errno(ENOSYS);
@ -4409,7 +4409,7 @@ static int get_config_seccomp_notify_cookie(const char *key, char *retv, int inl
static int get_config_seccomp_notify_proxy(const char *key, char *retv, int inlen, static int get_config_seccomp_notify_proxy(const char *key, char *retv, int inlen,
struct lxc_conf *c, void *data) struct lxc_conf *c, void *data)
{ {
#ifdef HAVE_SECCOMP_NOTIFY #if HAVE_DECL_SECCOMP_NOTIFY_FD
return lxc_get_conf_str(retv, inlen, return lxc_get_conf_str(retv, inlen,
(c->seccomp.notifier.proxy_addr.sun_path[0]) == '/' (c->seccomp.notifier.proxy_addr.sun_path[0]) == '/'
? &c->seccomp.notifier.proxy_addr.sun_path[0] ? &c->seccomp.notifier.proxy_addr.sun_path[0]
@ -5142,7 +5142,7 @@ static inline int clr_config_seccomp_allow_nesting(const char *key,
static inline int clr_config_seccomp_notify_cookie(const char *key, static inline int clr_config_seccomp_notify_cookie(const char *key,
struct lxc_conf *c, void *data) struct lxc_conf *c, void *data)
{ {
#ifdef HAVE_SECCOMP_NOTIFY #if HAVE_DECL_SECCOMP_NOTIFY_FD
free_disarm(c->seccomp.notifier.cookie); free_disarm(c->seccomp.notifier.cookie);
return 0; return 0;
#else #else
@ -5153,7 +5153,7 @@ static inline int clr_config_seccomp_notify_cookie(const char *key,
static inline int clr_config_seccomp_notify_proxy(const char *key, static inline int clr_config_seccomp_notify_proxy(const char *key,
struct lxc_conf *c, void *data) struct lxc_conf *c, void *data)
{ {
#ifdef HAVE_SECCOMP_NOTIFY #if HAVE_DECL_SECCOMP_NOTIFY_FD
memset(&c->seccomp.notifier.proxy_addr, 0, memset(&c->seccomp.notifier.proxy_addr, 0,
sizeof(c->seccomp.notifier.proxy_addr)); sizeof(c->seccomp.notifier.proxy_addr));
return 0; return 0;

4
src/lxc/lxcseccomp.h
View File

@ -6,10 +6,12 @@
#include "config.h" #include "config.h"
#include <errno.h> #include <errno.h>
#ifdef HAVE_SECCOMP #ifdef HAVE_SECCOMP
#include <linux/seccomp.h> #include <linux/seccomp.h>
#include <seccomp.h> #include <seccomp.h>
#endif #endif
#if HAVE_DECL_SECCOMP_NOTIFY_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
#include <sys/socket.h> #include <sys/socket.h>
#include <sys/un.h> #include <sys/un.h>
@ -60,8 +62,6 @@ struct seccomp_notify {
char *cookie; char *cookie;
}; };
#define HAVE_SECCOMP_NOTIFY 1
#endif /* HAVE_DECL_SECCOMP_NOTIFY_FD */ #endif /* HAVE_DECL_SECCOMP_NOTIFY_FD */
struct lxc_seccomp { struct lxc_seccomp {