SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tree-wide: avoid some loaded terms

Browse Source 
https://tools.ietf.org/html/draft-knodel-terminology-02
https://lwn.net/Articles/823224/

This gets rid of most but not occasions of these loaded terms:

1. scsi_id and friends are something that is supposed to be removed from
   our tree (see #7594)

2. The test suite defines an API used by the ubuntu CI. We can remove
   this too later, but this needs to be done in sync with the ubuntu CI.

3. In some cases the terms are part of APIs we call or where we expose
   concepts the kernel names the way it names them. (In particular all
   remaining uses of the word "slave" in our codebase are like this,
   it's used by the POSIX PTY layer, by the network subsystem, the mount
   API and the block device subsystem). Getting rid of the term in these
   contexts would mean doing some major fixes of the kernel ABI first.

Regarding the replacements: when whitelist/blacklist is used as noun we
replace with with allow list/deny list, and when used as verb with
allow-list/deny-list.
This commit is contained in:
Lennart Poettering
2020-06-25 09:00:19 +02:00
committed by Zbigniew Jędrzejewski-Szmek
parent b18573e16f
commit 6b000af4f2
51 changed files with 365 additions and 354 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nspawn/nspawn-oci.c
+14 -13
View File
@@ -57,7 +57,7 @@
* spec should say what to do with unknown props
* /bin/mount regarding NFS and FUSE required?
* what does terminal=false mean?
* sysctl inside or outside? whitelisting?
* sysctl inside or outside? allow-listing?
* swapiness typo -> swappiness
*
* Unsupported:
@@ -1029,39 +1029,40 @@ static int oci_cgroup_devices(const char *name, JsonVariant *v, JsonDispatchFlag
return r;
if (!data.allow) {
/* The fact that OCI allows 'deny' entries makes really no sense, as 'allow' vs. 'deny' for the
* devices cgroup controller is really not about whitelisting and blacklisting but about adding
* and removing entries from the whitelist. Since we always start out with an empty whitelist
* we hence ignore the whole thing, as removing entries which don't exist make no sense. We'll
* log about this, since this is really borked in the spec, with one exception: the entry
* that's supposed to drop the kernel's default we ignore silently */
/* The fact that OCI allows 'deny' entries makes really no sense, as 'allow'
* vs. 'deny' for the devices cgroup controller is really not about allow-listing and
* deny-listing but about adding and removing entries from the allow list. Since we
* always start out with an empty allow list we hence ignore the whole thing, as
* removing entries which don't exist make no sense. We'll log about this, since this
* is really borked in the spec, with one exception: the entry that's supposed to
* drop the kernel's default we ignore silently */
if (!data.r || !data.w || !data.m || data.type != 0 || data.major != (unsigned) -1 || data.minor != (unsigned) -1)
json_log(v, flags|JSON_WARNING, 0, "Devices cgroup whitelist with arbitrary 'allow' entries not supported, ignoring.");
json_log(v, flags|JSON_WARNING, 0, "Devices cgroup allow list with arbitrary 'allow' entries not supported, ignoring.");
/* We ignore the 'deny' entry as for us that's implied */
continue;
}
if (!data.r && !data.w && !data.m) {
json_log(v, flags|LOG_WARNING, 0, "Device cgroup whitelist entry with no effect found, ignoring.");
json_log(v, flags|LOG_WARNING, 0, "Device cgroup allow list entry with no effect found, ignoring.");
continue;
}
if (data.minor != (unsigned) -1 && data.major == (unsigned) -1)
return json_log(v, flags, SYNTHETIC_ERRNO(EOPNOTSUPP),
"Device cgroup whitelist entries with minors but no majors not supported.");
"Device cgroup allow list entries with minors but no majors not supported.");
if (data.major != (unsigned) -1 && data.type == 0)
return json_log(v, flags, SYNTHETIC_ERRNO(EOPNOTSUPP),
"Device cgroup whitelist entries with majors but no device node type not supported.");
"Device cgroup allow list entries with majors but no device node type not supported.");
if (data.type == 0) {
if (data.r && data.w && data.m) /* a catchall whitelist entry means we are looking at a noop */
if (data.r && data.w && data.m) /* a catchall allow list entry means we are looking at a noop */
noop = true;
else
return json_log(v, flags, SYNTHETIC_ERRNO(EOPNOTSUPP),
"Device cgroup whitelist entries with no type not supported.");
"Device cgroup allow list entries with no type not supported.");
}
a = reallocarray(list, n_list + 1, sizeof(struct device_data));
src/nspawn/nspawn-seccomp.c
+13 -13
View File
@@ -25,13 +25,13 @@ static int seccomp_add_default_syscall_filter(
scmp_filter_ctx ctx,
uint32_t arch,
uint64_t cap_list_retain,
char **syscall_whitelist,
char **syscall_blacklist) {
char **syscall_allow_list,
char **syscall_deny_list) {
static const struct {
uint64_t capability;
const char* name;
} whitelist[] = {
} allow_list[] = {
/* Let's use set names where we can */
{ 0, "@aio" },
{ 0, "@basic-io" },
@@ -142,17 +142,17 @@ static int seccomp_add_default_syscall_filter(
char **p;
int r;
for (size_t i = 0; i < ELEMENTSOF(whitelist); i++) {
if (whitelist[i].capability != 0 && (cap_list_retain & (1ULL << whitelist[i].capability)) == 0)
for (size_t i = 0; i < ELEMENTSOF(allow_list); i++) {
if (allow_list[i].capability != 0 && (cap_list_retain & (1ULL << allow_list[i].capability)) == 0)
continue;
r = seccomp_add_syscall_filter_item(ctx, whitelist[i].name, SCMP_ACT_ALLOW, syscall_blacklist, false);
r = seccomp_add_syscall_filter_item(ctx, allow_list[i].name, SCMP_ACT_ALLOW, syscall_deny_list, false);
if (r < 0)
return log_error_errno(r, "Failed to add syscall filter item %s: %m", whitelist[i].name);
return log_error_errno(r, "Failed to add syscall filter item %s: %m", allow_list[i].name);
}
STRV_FOREACH(p, syscall_whitelist) {
r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_blacklist, true);
STRV_FOREACH(p, syscall_allow_list) {
r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_deny_list, true);
if (r < 0)
log_warning_errno(r, "Failed to add rule for system call %s on %s, ignoring: %m",
*p, seccomp_arch_to_string(arch));
@@ -161,7 +161,7 @@ static int seccomp_add_default_syscall_filter(
return 0;
}
int setup_seccomp(uint64_t cap_list_retain, char **syscall_whitelist, char **syscall_blacklist) {
int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_list, char **syscall_deny_list) {
uint32_t arch;
int r;
@@ -173,13 +173,13 @@ int setup_seccomp(uint64_t cap_list_retain, char **syscall_whitelist, char **sys
SECCOMP_FOREACH_LOCAL_ARCH(arch) {
_cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL;
log_debug("Applying whitelist on architecture: %s", seccomp_arch_to_string(arch));
log_debug("Applying allow list on architecture: %s", seccomp_arch_to_string(arch));
r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ERRNO(EPERM));
if (r < 0)
return log_error_errno(r, "Failed to allocate seccomp object: %m");
r = seccomp_add_default_syscall_filter(seccomp, arch, cap_list_retain, syscall_whitelist, syscall_blacklist);
r = seccomp_add_default_syscall_filter(seccomp, arch, cap_list_retain, syscall_allow_list, syscall_deny_list);
if (r < 0)
return r;
@@ -231,7 +231,7 @@ int setup_seccomp(uint64_t cap_list_retain, char **syscall_whitelist, char **sys
#else
int setup_seccomp(uint64_t cap_list_retain, char **syscall_whitelist, char **syscall_blacklist) {
int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_list, char **syscall_deny_list) {
return 0;
}
src/nspawn/nspawn-seccomp.h
+1 -1
View File
@@ -3,4 +3,4 @@
#include <sys/types.h>
int setup_seccomp(uint64_t cap_list_retain, char **syscall_whitelist, char **syscall_blacklist);
int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_ist, char **syscall_deny_list);
src/nspawn/nspawn-settings.c
+4 -4
View File
@@ -129,8 +129,8 @@ Settings* settings_free(Settings *s) {
free(s->pivot_root_new);
free(s->pivot_root_old);
free(s->working_directory);
strv_free(s->syscall_whitelist);
strv_free(s->syscall_blacklist);
strv_free(s->syscall_allow_list);
strv_free(s->syscall_deny_list);
rlimit_free_all(s->rlimit);
free(s->hostname);
cpu_set_reset(&s->cpu_set);
@@ -689,9 +689,9 @@ int config_parse_syscall_filter(
}
if (negative)
r = strv_extend(&settings->syscall_blacklist, word);
r = strv_extend(&settings->syscall_deny_list, word);
else
r = strv_extend(&settings->syscall_whitelist, word);
r = strv_extend(&settings->syscall_allow_list, word);
if (r < 0)
return log_oom();
}
src/nspawn/nspawn-settings.h
+2 -2
View File
@@ -165,8 +165,8 @@ typedef struct Settings {
UserNamespaceMode userns_mode;
uid_t uid_shift, uid_range;
bool notify_ready;
char **syscall_whitelist;
char **syscall_blacklist;
char **syscall_allow_list;
char **syscall_deny_list;
struct rlimit *rlimit[_RLIMIT_MAX];
char *hostname;
int no_new_privileges;
src/nspawn/nspawn.c
+15 -14
View File
@@ -201,8 +201,8 @@ static MountSettingsMask arg_mount_settings = MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_
static void *arg_root_hash = NULL;
static char *arg_verity_data = NULL;
static size_t arg_root_hash_size = 0;
static char **arg_syscall_whitelist = NULL;
static char **arg_syscall_blacklist = NULL;
static char **arg_syscall_allow_list = NULL;
static char **arg_syscall_deny_list = NULL;
#if HAVE_SECCOMP
static scmp_filter_ctx arg_seccomp = NULL;
#endif
@@ -244,8 +244,8 @@ STATIC_DESTRUCTOR_REGISTER(arg_property_message, sd_bus_message_unrefp);
STATIC_DESTRUCTOR_REGISTER(arg_parameters, strv_freep);
STATIC_DESTRUCTOR_REGISTER(arg_root_hash, freep);
STATIC_DESTRUCTOR_REGISTER(arg_verity_data, freep);
STATIC_DESTRUCTOR_REGISTER(arg_syscall_whitelist, strv_freep);
STATIC_DESTRUCTOR_REGISTER(arg_syscall_blacklist, strv_freep);
STATIC_DESTRUCTOR_REGISTER(arg_syscall_allow_list, strv_freep);
STATIC_DESTRUCTOR_REGISTER(arg_syscall_deny_list, strv_freep);
#if HAVE_SECCOMP
STATIC_DESTRUCTOR_REGISTER(arg_seccomp, seccomp_releasep);
#endif
@@ -1346,9 +1346,9 @@ static int parse_argv(int argc, char *argv[]) {
return log_error_errno(r, "Failed to parse system call filter: %m");
if (negative)
r = strv_extend(&arg_syscall_blacklist, word);
r = strv_extend(&arg_syscall_deny_list, word);
else
r = strv_extend(&arg_syscall_whitelist, word);
r = strv_extend(&arg_syscall_allow_list, word);
if (r < 0)
return log_oom();
}
@@ -2175,10 +2175,11 @@ static int setup_dev_console(const char *console) {
static int setup_keyring(void) {
key_serial_t keyring;
/* Allocate a new session keyring for the container. This makes sure the keyring of the session systemd-nspawn
* was invoked from doesn't leak into the container. Note that by default we block keyctl() and request_key()
* anyway via seccomp so doing this operation isn't strictly necessary, but in case people explicitly whitelist
* these system calls let's make sure we don't leak anything into the container. */
/* Allocate a new session keyring for the container. This makes sure the keyring of the session
* systemd-nspawn was invoked from doesn't leak into the container. Note that by default we block
* keyctl() and request_key() anyway via seccomp so doing this operation isn't strictly necessary,
* but in case people explicitly allow-list these system calls let's make sure we don't leak anything
* into the container. */
keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
if (keyring == -1) {
@@ -3089,7 +3090,7 @@ static int inner_child(
} else
#endif
{
r = setup_seccomp(arg_caps_retain, arg_syscall_whitelist, arg_syscall_blacklist);
r = setup_seccomp(arg_caps_retain, arg_syscall_allow_list, arg_syscall_deny_list);
if (r < 0)
return r;
}
@@ -3954,11 +3955,11 @@ static int merge_settings(Settings *settings, const char *path) {
if ((arg_settings_mask & SETTING_SYSCALL_FILTER) == 0) {
if (!arg_settings_trusted && !strv_isempty(settings->syscall_whitelist))
if (!arg_settings_trusted && !strv_isempty(settings->syscall_allow_list))
log_warning("Ignoring SystemCallFilter= settings, file %s is not trusted.", path);
else {
strv_free_and_replace(arg_syscall_whitelist, settings->syscall_whitelist);
strv_free_and_replace(arg_syscall_blacklist, settings->syscall_blacklist);
strv_free_and_replace(arg_syscall_allow_list, settings->syscall_allow_list);
strv_free_and_replace(arg_syscall_deny_list, settings->syscall_deny_list);
}
#if HAVE_SECCOMP