From e7854c46be0470e5372dba2712ca5cc8dd0e26f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 15 Jul 2017 19:25:19 +0000 Subject: [PATCH 1/4] shared/seccomp-util: add parentheses and no. after syscall name "Failed to add rule for system call access, ignoring: Numerical argument out of domain" is confusing. Make that "... system call access() / 238". (cherry picked from commit 977dc6ca5acb8069a2966ec63e7378576bc2ca51) --- src/shared/seccomp-util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index 36843d4bf5..476bff1260 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -692,7 +692,7 @@ static int seccomp_add_syscall_filter_set( r = seccomp_rule_add_exact(seccomp, action, id, 0); if (r < 0) /* If the system call is not known on this architecture, then that's fine, let's ignore it */ - log_debug_errno(r, "Failed to add rule for system call %s, ignoring: %m", sys); + log_debug_errno(r, "Failed to add rule for system call %s() / %d, ignoring: %m", sys, id); } } @@ -761,7 +761,7 @@ int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Set* set, uint3 _cleanup_free_ char *n = NULL; n = seccomp_syscall_resolve_num_arch(arch, PTR_TO_INT(id) - 1); - log_debug_errno(r, "Failed to add rule for system call %s, ignoring: %m", strna(n)); + log_debug_errno(r, "Failed to add rule for system call %s() / %d, ignoring: %m", strna(n), PTR_TO_INT(id) - 1); } } From 2e64e8f46d726689a44d4084226fe3e0ea255c29 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 15 Jul 2017 19:28:02 +0000 Subject: [PATCH 2/4] seccomp: arm64/x32 do not have _sysctl So don't even try to added the filter to reduce noise. The test is updated to skip calling _sysctl because the kernel prints an oops-like message that is confusing and unhelpful: Jul 15 21:07:01 rpi3 kernel: test-seccomp[8448]: syscall -10080 Jul 15 21:07:01 rpi3 kernel: Code: aa0503e4 aa0603e5 aa0703e6 d4000001 (b13ffc1f) Jul 15 21:07:01 rpi3 kernel: CPU: 3 PID: 8448 Comm: test-seccomp Tainted: G W 4.11.8-300.fc26.aarch64 #1 Jul 15 21:07:01 rpi3 kernel: Hardware name: raspberrypi rpi/rpi, BIOS 2017.05 06/24/2017 Jul 15 21:07:01 rpi3 kernel: task: ffff80002bb0bb00 task.stack: ffff800036354000 Jul 15 21:07:01 rpi3 kernel: PC is at 0xffff8669c7c4 Jul 15 21:07:01 rpi3 kernel: LR is at 0xaaaac64b6750 Jul 15 21:07:01 rpi3 kernel: pc : [<0000ffff8669c7c4>] lr : [<0000aaaac64b6750>] pstate: 60000000 Jul 15 21:07:01 rpi3 kernel: sp : 0000ffffdc640fd0 Jul 15 21:07:01 rpi3 kernel: x29: 0000ffffdc640fd0 x28: 0000000000000000 Jul 15 21:07:01 rpi3 kernel: x27: 0000000000000000 x26: 0000000000000000 Jul 15 21:07:01 rpi3 kernel: x25: 0000000000000000 x24: 0000000000000000 Jul 15 21:07:01 rpi3 kernel: x23: 0000000000000000 x22: 0000000000000000 Jul 15 21:07:01 rpi3 kernel: x21: 0000aaaac64b4940 x20: 0000000000000000 Jul 15 21:07:01 rpi3 kernel: x19: 0000aaaac64b88f8 x18: 0000000000000020 Jul 15 21:07:01 rpi3 kernel: x17: 0000ffff8669c7a0 x16: 0000aaaac64d2ee0 Jul 15 21:07:01 rpi3 kernel: x15: 0000000000000000 x14: 0000000000000000 Jul 15 21:07:01 rpi3 kernel: x13: 203a657275746365 x12: 0000000000000000 Jul 15 21:07:01 rpi3 kernel: x11: 0000ffffdc640418 x10: 0000000000000000 Jul 15 21:07:01 rpi3 kernel: x9 : 0000000000000005 x8 : 00000000ffffd8a0 Jul 15 21:07:01 rpi3 kernel: x7 : 7f7f7f7f7f7f7f7f x6 : 7f7f7f7f7f7f7f7f Jul 15 21:07:01 rpi3 kernel: x5 : 65736d68716f7277 x4 : 0000000000000000 Jul 15 21:07:01 rpi3 kernel: x3 : 0000000000000008 x2 : 0000000000000000 Jul 15 21:07:01 rpi3 kernel: x1 : 0000000000000000 x0 : 0000000000000000 Jul 15 21:07:01 rpi3 kernel: (cherry picked from commit 1e20e640132c700c23494bb9e2619afb83878380) --- src/shared/seccomp-util.c | 4 ++++ src/test/test-seccomp.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index 476bff1260..1c3706a8cc 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -899,6 +899,10 @@ int seccomp_protect_sysctl(void) { log_debug("Operating on architecture: %s", seccomp_arch_to_string(arch)); + if (IN_SET(arch, SCMP_ARCH_X32, SCMP_ARCH_AARCH64)) + /* No _sysctl syscall */ + continue; + r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ALLOW); if (r < 0) return r; diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c index efd145e063..50fe24c794 100644 --- a/src/test/test-seccomp.c +++ b/src/test/test-seccomp.c @@ -244,13 +244,17 @@ static void test_protect_sysctl(void) { assert_se(pid >= 0); if (pid == 0) { +#if __NR__sysctl > 0 assert_se(syscall(__NR__sysctl, NULL) < 0); assert_se(errno == EFAULT); +#endif assert_se(seccomp_protect_sysctl() >= 0); +#if __NR__sysctl > 0 assert_se(syscall(__NR__sysctl, 0, 0, 0) < 0); assert_se(errno == EPERM); +#endif _exit(EXIT_SUCCESS); } From 79873bc850177050baa0c5165b119adafeebb891 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 15 Jul 2017 19:30:01 +0000 Subject: [PATCH 3/4] seccomp: arm64 does not have mmap2 I messed up when adding the definitions in 4278d1f5310f5acb4c6a6788233625234edb5145. Unfortunately I didn't have the hardware at hand and went by looking at the kernel headers. (cherry picked from commit 53196fafcb7b24b45ed4f48ab894d00a24a6d871) --- src/shared/seccomp-util.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index 1c3706a8cc..5d8a6986b7 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -1223,10 +1223,6 @@ int seccomp_memory_deny_write_execute(void) { break; - case SCMP_ARCH_AARCH64: - block_syscall = SCMP_SYS(mmap); - /* fall through */ - case SCMP_ARCH_ARM: filter_syscall = SCMP_SYS(mmap2); /* arm has only mmap2 */ shmat_syscall = SCMP_SYS(shmat); @@ -1234,7 +1230,8 @@ int seccomp_memory_deny_write_execute(void) { case SCMP_ARCH_X86_64: case SCMP_ARCH_X32: - filter_syscall = SCMP_SYS(mmap); /* amd64 and x32 have only mmap */ + case SCMP_ARCH_AARCH64: + filter_syscall = SCMP_SYS(mmap); /* amd64, x32, and arm64 have only mmap */ shmat_syscall = SCMP_SYS(shmat); break; From f60a865a496e1e6fde7436b4013dd8ff677f29a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 15 Jul 2017 19:30:48 +0000 Subject: [PATCH 4/4] test-seccomp: arm64 does not have access() and poll() glibc uses faccessat and ppoll, so just add a filters for that. (cherry picked from commit abc0213839fef92e2e2b98a434914f22ece48490) --- src/test/test-seccomp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c index 50fe24c794..28fe206507 100644 --- a/src/test/test-seccomp.c +++ b/src/test/test-seccomp.c @@ -529,7 +529,11 @@ static void test_load_syscall_filter_set_raw(void) { assert_se(poll(NULL, 0, 0) == 0); assert_se(s = set_new(NULL)); +#if SCMP_SYS(access) >= 0 assert_se(set_put(s, UINT32_TO_PTR(__NR_access + 1)) >= 0); +#else + assert_se(set_put(s, UINT32_TO_PTR(__NR_faccessat + 1)) >= 0); +#endif assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUCLEAN)) >= 0); @@ -541,7 +545,11 @@ static void test_load_syscall_filter_set_raw(void) { s = set_free(s); assert_se(s = set_new(NULL)); +#if SCMP_SYS(poll) >= 0 assert_se(set_put(s, UINT32_TO_PTR(__NR_poll + 1)) >= 0); +#else + assert_se(set_put(s, UINT32_TO_PTR(__NR_ppoll + 1)) >= 0); +#endif assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUNATCH)) >= 0);