mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-09-01 12:11:13 +00:00
Code Issues Releases Wiki Activity

Merge pull request #3037 from brauner/master

Browse Source 
seccomp: align with upstream libseccomp
This commit is contained in:
Stéphane Graber
2019-06-11 17:43:10 -04:00
committed by GitHub
parent e9ab177d3f d7d2d2d9a5
commit 76b65b40c2
3 changed files with 30 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
configure.ac
View File

@@ -363,7 +363,7 @@ AM_COND_IF([ENABLE_CAP],
OLD_CFLAGS="$CFLAGS" OLD_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $SECCOMP_CFLAGS" CFLAGS="$CFLAGS $SECCOMP_CFLAGS"
AC_CHECK_TYPES([scmp_filter_ctx], [], [], [[#include <seccomp.h>]]) AC_CHECK_TYPES([scmp_filter_ctx], [], [], [[#include <seccomp.h>]])
AC_CHECK_DECLS([seccomp_notif_get_fd], [], [], [[#include <seccomp.h>]]) AC_CHECK_DECLS([seccomp_notify_fd], [], [], [[#include <seccomp.h>]])
AC_CHECK_DECLS([seccomp_syscall_resolve_name_arch], [], [], [[#include <seccomp.h>]]) AC_CHECK_DECLS([seccomp_syscall_resolve_name_arch], [], [], [[#include <seccomp.h>]])
CFLAGS="$OLD_CFLAGS" CFLAGS="$OLD_CFLAGS"

12
src/lxc/lxcseccomp.h
View File

@@ -32,7 +32,7 @@
#include <linux/seccomp.h> #include <linux/seccomp.h>
#include <seccomp.h> #include <seccomp.h>
#endif #endif
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
#include <sys/socket.h> #include <sys/socket.h>
#include <sys/un.h> #include <sys/un.h>
#endif #endif
@@ -48,7 +48,7 @@ struct lxc_handler;
#ifdef HAVE_SECCOMP #ifdef HAVE_SECCOMP
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
struct seccomp_notify_proxy_msg { struct seccomp_notify_proxy_msg {
uint32_t version; uint32_t version;
@@ -69,7 +69,7 @@ struct seccomp_notify {
#define HAVE_SECCOMP_NOTIFY 1 #define HAVE_SECCOMP_NOTIFY 1
#endif /* HAVE_DECL_SECCOMP_NOTIF_GET_FD */ #endif /* HAVE_DECL_SECCOMP_NOTIFY_FD */
struct lxc_seccomp { struct lxc_seccomp {
char *seccomp; char *seccomp;
@@ -78,9 +78,9 @@ struct lxc_seccomp {
scmp_filter_ctx seccomp_ctx; scmp_filter_ctx seccomp_ctx;
#endif /* HAVE_SCMP_FILTER_CTX */ #endif /* HAVE_SCMP_FILTER_CTX */
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
struct seccomp_notify notifier; struct seccomp_notify notifier;
#endif /* HAVE_DECL_SECCOMP_NOTIF_GET_FD */ #endif /* HAVE_DECL_SECCOMP_NOTIFY_FD */
}; };
extern int lxc_seccomp_load(struct lxc_conf *conf); extern int lxc_seccomp_load(struct lxc_conf *conf);
@@ -100,7 +100,7 @@ extern int lxc_seccomp_add_notifier(const char *name, const char *lxcpath,
struct lxc_seccomp *seccomp); struct lxc_seccomp *seccomp);
static inline int lxc_seccomp_get_notify_fd(struct lxc_seccomp *seccomp) static inline int lxc_seccomp_get_notify_fd(struct lxc_seccomp *seccomp)
{ {
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
return seccomp->notifier.notify_fd; return seccomp->notifier.notify_fd;
#else #else
errno = ENOSYS; errno = ENOSYS;

46
src/lxc/seccomp.c
View File

@@ -92,8 +92,8 @@ static const char *get_action_name(uint32_t action)
return "trap"; return "trap";
case SCMP_ACT_ERRNO(0): case SCMP_ACT_ERRNO(0):
return "errno"; return "errno";
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
case SCMP_ACT_USER_NOTIF: case SCMP_ACT_NOTIFY:
return "notify"; return "notify";
#endif #endif
} }
@@ -125,9 +125,9 @@ static uint32_t get_v2_default_action(char *line)
ret_action = SCMP_ACT_ALLOW; ret_action = SCMP_ACT_ALLOW;
} else if (strncmp(line, "trap", 4) == 0) { } else if (strncmp(line, "trap", 4) == 0) {
ret_action = SCMP_ACT_TRAP; ret_action = SCMP_ACT_TRAP;
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
} else if (strncmp(line, "notify", 6) == 0) { } else if (strncmp(line, "notify", 6) == 0) {
ret_action = SCMP_ACT_USER_NOTIF; ret_action = SCMP_ACT_NOTIFY;
#endif #endif
} else if (line[0]) { } else if (line[0]) {
ERROR("Unrecognized seccomp action \"%s\"", line); ERROR("Unrecognized seccomp action \"%s\"", line);
@@ -941,8 +941,8 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
goto bad_rule; goto bad_rule;
} }
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
if ((rule.action == SCMP_ACT_USER_NOTIF) && if ((rule.action == SCMP_ACT_NOTIFY) &&
!conf->seccomp.notifier.wants_supervision) { !conf->seccomp.notifier.wants_supervision) {
ret = seccomp_attr_set(conf->seccomp.seccomp_ctx, ret = seccomp_attr_set(conf->seccomp.seccomp_ctx,
SCMP_FLTATR_NEW_LISTENER, 1); SCMP_FLTATR_NEW_LISTENER, 1);
@@ -1256,9 +1256,9 @@ int lxc_seccomp_load(struct lxc_conf *conf)
} }
#endif #endif
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
if (conf->seccomp.notifier.wants_supervision) { if (conf->seccomp.notifier.wants_supervision) {
ret = seccomp_notif_get_fd(conf->seccomp.seccomp_ctx); ret = seccomp_notify_fd(conf->seccomp.seccomp_ctx);
if (ret < 0) { if (ret < 0) {
errno = -ret; errno = -ret;
return -1; return -1;
@@ -1283,16 +1283,16 @@ void lxc_seccomp_free(struct lxc_seccomp *seccomp)
} }
#endif #endif
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
close_prot_errno_disarm(seccomp->notifier.notify_fd); close_prot_errno_disarm(seccomp->notifier.notify_fd);
close_prot_errno_disarm(seccomp->notifier.proxy_fd); close_prot_errno_disarm(seccomp->notifier.proxy_fd);
seccomp_notif_free(seccomp->notifier.req_buf, seccomp->notifier.rsp_buf); seccomp_notify_free(seccomp->notifier.req_buf, seccomp->notifier.rsp_buf);
seccomp->notifier.req_buf = NULL; seccomp->notifier.req_buf = NULL;
seccomp->notifier.rsp_buf = NULL; seccomp->notifier.rsp_buf = NULL;
#endif #endif
} }
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
static int seccomp_notify_reconnect(struct lxc_handler *handler) static int seccomp_notify_reconnect(struct lxc_handler *handler)
{ {
__do_close_prot_errno int notify_fd = -EBADF; __do_close_prot_errno int notify_fd = -EBADF;
@@ -1315,7 +1315,7 @@ static int seccomp_notify_reconnect(struct lxc_handler *handler)
} }
#endif #endif
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
static int seccomp_notify_default_answer(int fd, struct seccomp_notif *req, static int seccomp_notify_default_answer(int fd, struct seccomp_notif *req,
struct seccomp_notif_resp *resp, struct seccomp_notif_resp *resp,
struct lxc_handler *handler) struct lxc_handler *handler)
@@ -1323,7 +1323,7 @@ static int seccomp_notify_default_answer(int fd, struct seccomp_notif *req,
resp->id = req->id; resp->id = req->id;
resp->error = -ENOSYS; resp->error = -ENOSYS;
if (seccomp_notif_send_resp(fd, resp)) if (seccomp_notify_respond(fd, resp))
SYSERROR("Failed to send default message to seccomp"); SYSERROR("Failed to send default message to seccomp");
return seccomp_notify_reconnect(handler); return seccomp_notify_reconnect(handler);
@@ -1334,7 +1334,7 @@ int seccomp_notify_handler(int fd, uint32_t events, void *data,
struct lxc_epoll_descr *descr) struct lxc_epoll_descr *descr)
{ {
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
__do_close_prot_errno int fd_mem = -EBADF; __do_close_prot_errno int fd_mem = -EBADF;
int reconnect_count, ret; int reconnect_count, ret;
ssize_t bytes; ssize_t bytes;
@@ -1354,7 +1354,7 @@ int seccomp_notify_handler(int fd, uint32_t events, void *data,
return minus_one_set_errno(EINVAL); return minus_one_set_errno(EINVAL);
} }
ret = seccomp_notif_receive(fd, req); ret = seccomp_notify_receive(fd, req);
if (ret) { if (ret) {
SYSERROR("Failed to read seccomp notification"); SYSERROR("Failed to read seccomp notification");
goto out; goto out;
@@ -1372,7 +1372,7 @@ int seccomp_notify_handler(int fd, uint32_t events, void *data,
* Make sure that the fd for /proc/<pid>/mem we just opened still * Make sure that the fd for /proc/<pid>/mem we just opened still
* refers to the correct process's memory. * refers to the correct process's memory.
*/ */
ret = seccomp_notif_id_valid(fd, req->id); ret = seccomp_notify_id_valid(fd, req->id);
if (ret < 0) { if (ret < 0) {
(void)seccomp_notify_default_answer(fd, req, resp, hdlr); (void)seccomp_notify_default_answer(fd, req, resp, hdlr);
SYSERROR("Invalid seccomp notify request id"); SYSERROR("Invalid seccomp notify request id");
@@ -1407,7 +1407,7 @@ int seccomp_notify_handler(int fd, uint32_t events, void *data,
} while (reconnect_count++); } while (reconnect_count++);
memcpy(resp, &msg.resp, sizeof(*resp)); memcpy(resp, &msg.resp, sizeof(*resp));
ret = seccomp_notif_send_resp(fd, resp); ret = seccomp_notify_respond(fd, resp);
if (ret) if (ret)
SYSERROR("Failed to send seccomp notification"); SYSERROR("Failed to send seccomp notification");
@@ -1425,7 +1425,7 @@ void seccomp_conf_init(struct lxc_conf *conf)
conf->seccomp.allow_nesting = 0; conf->seccomp.allow_nesting = 0;
memset(&conf->seccomp.seccomp_ctx, 0, sizeof(conf->seccomp.seccomp_ctx)); memset(&conf->seccomp.seccomp_ctx, 0, sizeof(conf->seccomp.seccomp_ctx));
#endif /* HAVE_SCMP_FILTER_CTX */ #endif /* HAVE_SCMP_FILTER_CTX */
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
conf->seccomp.notifier.wants_supervision = false; conf->seccomp.notifier.wants_supervision = false;
conf->seccomp.notifier.notify_fd = -EBADF; conf->seccomp.notifier.notify_fd = -EBADF;
conf->seccomp.notifier.proxy_fd = -EBADF; conf->seccomp.notifier.proxy_fd = -EBADF;
@@ -1440,7 +1440,7 @@ int lxc_seccomp_setup_proxy(struct lxc_seccomp *seccomp,
struct lxc_epoll_descr *descr, struct lxc_epoll_descr *descr,
struct lxc_handler *handler) struct lxc_handler *handler)
{ {
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
if (seccomp->notifier.wants_supervision && if (seccomp->notifier.wants_supervision &&
seccomp->notifier.proxy_addr.sun_path[1] != '\0') { seccomp->notifier.proxy_addr.sun_path[1] != '\0') {
__do_close_prot_errno int notify_fd = -EBADF; __do_close_prot_errno int notify_fd = -EBADF;
@@ -1459,7 +1459,7 @@ int lxc_seccomp_setup_proxy(struct lxc_seccomp *seccomp,
return -1; return -1;
} }
ret = seccomp_notif_alloc(&seccomp->notifier.req_buf, ret = seccomp_notify_alloc(&seccomp->notifier.req_buf,
&seccomp->notifier.rsp_buf); &seccomp->notifier.rsp_buf);
if (ret) { if (ret) {
ERROR("Failed to allocate seccomp notify request and response buffers"); ERROR("Failed to allocate seccomp notify request and response buffers");
@@ -1484,7 +1484,7 @@ int lxc_seccomp_setup_proxy(struct lxc_seccomp *seccomp,
int lxc_seccomp_send_notifier_fd(struct lxc_seccomp *seccomp, int socket_fd) int lxc_seccomp_send_notifier_fd(struct lxc_seccomp *seccomp, int socket_fd)
{ {
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
if (seccomp->notifier.wants_supervision) { if (seccomp->notifier.wants_supervision) {
if (lxc_abstract_unix_send_fds(socket_fd, if (lxc_abstract_unix_send_fds(socket_fd,
&seccomp->notifier.notify_fd, 1, &seccomp->notifier.notify_fd, 1,
@@ -1498,7 +1498,7 @@ int lxc_seccomp_send_notifier_fd(struct lxc_seccomp *seccomp, int socket_fd)
int lxc_seccomp_recv_notifier_fd(struct lxc_seccomp *seccomp, int socket_fd) int lxc_seccomp_recv_notifier_fd(struct lxc_seccomp *seccomp, int socket_fd)
{ {
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
if (seccomp->notifier.wants_supervision) { if (seccomp->notifier.wants_supervision) {
int ret; int ret;
@@ -1516,7 +1516,7 @@ int lxc_seccomp_add_notifier(const char *name, const char *lxcpath,
struct lxc_seccomp *seccomp) struct lxc_seccomp *seccomp)
{ {
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIFY_FD
if (seccomp->notifier.wants_supervision) { if (seccomp->notifier.wants_supervision) {
int ret; int ret;