SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #21970 from yuwata/seccomp-util-fix-build

Browse Source 
seccomp-util: fix build failure
This commit is contained in:
Zbigniew Jędrzejewski-Szmek
2022-01-03 16:44:10 +01:00
committed by GitHub
parent 3fd864aea7 e83156c264
commit 7185af6234
15 changed files with 83 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/basic/missing_syscall_def.h
+66
View File
@@ -700,6 +700,72 @@ assert_cc(__NR_open_tree == systemd_NR_open_tree);
# endif
#endif
#ifndef __IGNORE_openat2
# if defined(__aarch64__)
# define systemd_NR_openat2 437
# elif defined(__alpha__)
# define systemd_NR_openat2 547
# elif defined(__arc__) || defined(__tilegx__)
# define systemd_NR_openat2 437
# elif defined(__arm__)
# define systemd_NR_openat2 437
# elif defined(__i386__)
# define systemd_NR_openat2 437
# elif defined(__ia64__)
# define systemd_NR_openat2 1461
# elif defined(__loongarch64)
# define systemd_NR_openat2 437
# elif defined(__m68k__)
# define systemd_NR_openat2 437
# elif defined(_MIPS_SIM)
# if _MIPS_SIM == _MIPS_SIM_ABI32
# define systemd_NR_openat2 4437
# elif _MIPS_SIM == _MIPS_SIM_NABI32
# define systemd_NR_openat2 6437
# elif _MIPS_SIM == _MIPS_SIM_ABI64
# define systemd_NR_openat2 5437
# else
# error "Unknown MIPS ABI"
# endif
# elif defined(__powerpc__)
# define systemd_NR_openat2 437
# elif defined(__riscv)
# if __riscv_xlen == 32
# define systemd_NR_openat2 437
# elif __riscv_xlen == 64
# define systemd_NR_openat2 437
# else
# error "Unknown RISC-V ABI"
# endif
# elif defined(__s390__)
# define systemd_NR_openat2 437
# elif defined(__sparc__)
# define systemd_NR_openat2 437
# elif defined(__x86_64__)
# if defined(__ILP32__)
# define systemd_NR_openat2 (437 | /* __X32_SYSCALL_BIT */ 0x40000000)
# else
# define systemd_NR_openat2 437
# endif
# elif !defined(missing_arch_template)
# warning "openat2() syscall number is unknown for your architecture"
# endif
/* may be an (invalid) negative number due to libseccomp, see PR 13319 */
# if defined __NR_openat2 && __NR_openat2 >= 0
# if defined systemd_NR_openat2
assert_cc(__NR_openat2 == systemd_NR_openat2);
# endif
# else
# if defined __NR_openat2
# undef __NR_openat2
# endif
# if defined systemd_NR_openat2 && systemd_NR_openat2 >= 0
# define __NR_openat2 systemd_NR_openat2
# endif
# endif
#endif
#ifndef __IGNORE_pidfd_open
# if defined(__aarch64__)
# define systemd_NR_pidfd_open 434
src/basic/missing_syscalls.py
+1
View File
@@ -16,6 +16,7 @@ SYSCALLS = [
'move_mount',
'name_to_handle_at',
'open_tree',
'openat2',
'pidfd_open',
'pidfd_send_signal',
'pkey_mprotect',
src/basic/syscalls-alpha.txt
+1 -1
View File
@@ -106,7 +106,7 @@ ftruncate 130
ftruncate64
futex 394
futex_time64
futex_waitv
futex_waitv 559
futimesat 454
get_kernel_syms 309
get_mempolicy 430
src/basic/syscalls-ia64.txt
+1 -1
View File
@@ -106,7 +106,7 @@ ftruncate 1098
ftruncate64
futex 1230
futex_time64
futex_waitv
futex_waitv 1473
futimesat 1285
get_kernel_syms
get_mempolicy 1260
src/basic/syscalls-loongarch64.txt
+1
View File
@@ -106,6 +106,7 @@ ftruncate 46
ftruncate64
futex 98
futex_time64
futex_waitv 449
futimesat
get_kernel_syms
get_mempolicy 236
src/basic/syscalls-m68k.txt
+1 -1
View File
@@ -106,7 +106,7 @@ ftruncate 93
ftruncate64 194
futex 235
futex_time64 422
futex_waitv
futex_waitv 449
futimesat 292
get_kernel_syms 130
get_mempolicy 269
src/basic/syscalls-mips64.txt
+1 -1
View File
@@ -106,7 +106,7 @@ ftruncate 5075
ftruncate64
futex 5194
futex_time64
futex_waitv
futex_waitv 5449
futimesat 5251
get_kernel_syms 5170
get_mempolicy 5228
src/basic/syscalls-mips64n32.txt
+1 -1
View File
@@ -106,7 +106,7 @@ ftruncate 6075
ftruncate64
futex 6194
futex_time64 6422
futex_waitv
futex_waitv 6449
futimesat 6255
get_kernel_syms 6170
get_mempolicy 6232
src/basic/syscalls-mipso32.txt
+1 -1
View File
@@ -106,7 +106,7 @@ ftruncate 4093
ftruncate64 4212
futex 4238
futex_time64 4422
futex_waitv
futex_waitv 4449
futimesat 4292
get_kernel_syms 4130
get_mempolicy 4269
src/basic/syscalls-powerpc.txt
+1 -1
View File
@@ -106,7 +106,7 @@ ftruncate 93
ftruncate64 194
futex 221
futex_time64 422
futex_waitv
futex_waitv 449
futimesat 290
get_kernel_syms 130
get_mempolicy 260
src/basic/syscalls-powerpc64.txt
+1 -1
View File
@@ -106,7 +106,7 @@ ftruncate 93
ftruncate64
futex 221
futex_time64
futex_waitv
futex_waitv 449
futimesat 290
get_kernel_syms 130
get_mempolicy 260
src/basic/syscalls-s390.txt
+1 -1
View File
@@ -106,7 +106,7 @@ ftruncate 93
ftruncate64 194
futex 238
futex_time64 422
futex_waitv
futex_waitv 449
futimesat 292
get_kernel_syms 130
get_mempolicy 269
src/basic/syscalls-s390x.txt
+1 -1
View File
@@ -106,7 +106,7 @@ ftruncate 93
ftruncate64
futex 238
futex_time64
futex_waitv
futex_waitv 449
futimesat 292
get_kernel_syms 130
get_mempolicy 269
src/basic/syscalls-sparc.txt
+1 -1
View File
@@ -106,7 +106,7 @@ ftruncate 130
ftruncate64 84
futex 142
futex_time64 422
futex_waitv
futex_waitv 449
futimesat 288
get_kernel_syms 223
get_mempolicy 304
src/shared/seccomp-util.c
+4 -7
View File
@@ -3,13 +3,16 @@
#include <errno.h>
#include <fcntl.h>
#include <linux/seccomp.h>
#include <seccomp.h>
#include <stddef.h>
#include <sys/mman.h>
#include <sys/prctl.h>
#include <sys/shm.h>
#include <sys/stat.h>
/* include missing_syscall_def.h earlier to make __SNR_foo mapped to __NR_foo. */
#include "missing_syscall_def.h"
#include <seccomp.h>
#include "af-list.h"
#include "alloc-util.h"
#include "env-util.h"
@@ -1736,13 +1739,11 @@ int seccomp_memory_deny_write_execute(void) {
if (r < 0)
continue;
#ifdef __NR_pkey_mprotect
r = add_seccomp_syscall_filter(seccomp, arch, SCMP_SYS(pkey_mprotect),
1,
SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC, PROT_EXEC));
if (r < 0)
continue;
#endif
if (shmat_syscall > 0) {
r = add_seccomp_syscall_filter(seccomp, arch, shmat_syscall,
@@ -2063,7 +2064,6 @@ static int seccomp_restrict_sxid(scmp_filter_ctx seccomp, mode_t m) {
else
any = true;
#if SCMP_SYS(open) > 0
r = seccomp_rule_add_exact(
seccomp,
SCMP_ACT_ERRNO(EPERM),
@@ -2075,7 +2075,6 @@ static int seccomp_restrict_sxid(scmp_filter_ctx seccomp, mode_t m) {
log_debug_errno(r, "Failed to add filter for open: %m");
else
any = true;
#endif
r = seccomp_rule_add_exact(
seccomp,
@@ -2213,7 +2212,6 @@ static int block_open_flag(scmp_filter_ctx seccomp, int flag) {
/* Blocks open() with the specified flag, where flag is O_SYNC or so. This makes these calls return
* EINVAL, in the hope the client code will retry without O_SYNC then. */
#if SCMP_SYS(open) > 0
r = seccomp_rule_add_exact(
seccomp,
SCMP_ACT_ERRNO(EINVAL),
@@ -2224,7 +2222,6 @@ static int block_open_flag(scmp_filter_ctx seccomp, int flag) {
log_debug_errno(r, "Failed to add filter for open: %m");
else
any = true;
#endif
r = seccomp_rule_add_exact(
seccomp,