mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-08-31 10:09:37 +00:00
Code Issues Releases Wiki Activity

seccomp: handle inverted arch

Browse Source 
lxc uses uname to check the kernel version.  Seccomp respects userspace.  In the case
of 32-bit userspace on 64-bit kernel, this was a bad combination.

When we run into that case, make sure that the compat seccomp context is 32-bit, and
the lxc->seccomp_ctx is the 64-bit.

Closes #654

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
This commit is contained in:
Serge Hallyn
2015-11-12 17:22:48 -06:00
parent 2681c0e7ea
commit 473ebc77d6
1 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/lxc/seccomp.c
View File

@@ -296,10 +296,19 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
if (native_arch == lxc_seccomp_arch_amd64) {
cur_rule_arch = lxc_seccomp_arch_all;
compat_arch = SCMP_ARCH_X86;
compat_ctx = get_new_ctx(lxc_seccomp_arch_i386,
default_policy_action);
if (!compat_ctx)
goto bad;
// Detect if we are on x86_64 kernel with 32-bit userspace
if (seccomp_arch_exist(conf->seccomp_ctx, SCMP_ARCH_X86)) {
compat_ctx = conf->seccomp_ctx;
conf->seccomp_ctx = get_new_ctx(lxc_seccomp_arch_amd64,
default_policy_action);
if (!conf->seccomp_ctx)
goto bad;
} else {
compat_ctx = get_new_ctx(lxc_seccomp_arch_i386,
default_policy_action);
if (!compat_ctx)
goto bad;
}
}
if (default_policy_action != SCMP_ACT_KILL) {