core: block PTRACE_POKE{TEXT,DATA} when RestrictFileSystemAccess= is enabled

PTRACE_POKETEXT and PTRACE_POKEDATA use FOLL_FORCE to forcibly write
into a tracee's memory. That includes executable read-only pages. If we
restrict execution to trusted binaries PID 1 must enforce that it's
impossible to abuse this to get untrusted code execution. Note, that
usermodehelpers are not subject to PID 1's seccomp filters.

Install a ptrace seccomp filter from PID 1 if RestrictFileSystemAccess=
is requested. Every process it spawns will inherit it.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

src/core/manager-serialize.c

@@ -519,7 +519,7 @@ static void manager_deserialize_gid_refs_one(Manager *m, const char *value) {
 
 static void deserialize_restrict_fsaccess(Manager *m, const char *l, FDSet *fds) {
         const char *val;
-        int fd;
+        int fd, r;
 
         FOREACH_ELEMENT(name, restrict_fsaccess_link_names) {
                 val = startswith(l, *name);
@@ -537,6 +537,17 @@ static void deserialize_restrict_fsaccess(Manager *m, const char *l, FDSet *fds)
                 return;
         }
 
+        val = startswith(l, "restrict-fsaccess-ptrace-filter=");
+        if (val) {
+                r = parse_boolean(val);
+                if (r < 0)
+                        log_warning_errno(r, "bpf-restrict-fsaccess: Failed to parse ptrace filter state '%s', "
+                                          "ignoring: %m", val);
+                else
+                        m->restrict_fsaccess_ptrace_filter = r;
+                return;
+        }
+
         val = startswith(l, "restrict-fsaccess-bss-map=");
         if (!val)
                 return;