From 0c718b1a67cd0d3512eafeb4659458694bf3865b Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 3 Jan 2022 03:48:10 +0900 Subject: [PATCH 1/3] syscalls: update syscall definitions --- src/basic/syscalls-alpha.txt | 2 +- src/basic/syscalls-ia64.txt | 2 +- src/basic/syscalls-loongarch64.txt | 1 + src/basic/syscalls-m68k.txt | 2 +- src/basic/syscalls-mips64.txt | 2 +- src/basic/syscalls-mips64n32.txt | 2 +- src/basic/syscalls-mipso32.txt | 2 +- src/basic/syscalls-powerpc.txt | 2 +- src/basic/syscalls-powerpc64.txt | 2 +- src/basic/syscalls-s390.txt | 2 +- src/basic/syscalls-s390x.txt | 2 +- src/basic/syscalls-sparc.txt | 2 +- 12 files changed, 12 insertions(+), 11 deletions(-) diff --git a/src/basic/syscalls-alpha.txt b/src/basic/syscalls-alpha.txt index 7d170ad412..5aef86b09e 100644 --- a/src/basic/syscalls-alpha.txt +++ b/src/basic/syscalls-alpha.txt @@ -106,7 +106,7 @@ ftruncate 130 ftruncate64 futex 394 futex_time64 -futex_waitv +futex_waitv 559 futimesat 454 get_kernel_syms 309 get_mempolicy 430 diff --git a/src/basic/syscalls-ia64.txt b/src/basic/syscalls-ia64.txt index 8770b1035f..3d646f6d17 100644 --- a/src/basic/syscalls-ia64.txt +++ b/src/basic/syscalls-ia64.txt @@ -106,7 +106,7 @@ ftruncate 1098 ftruncate64 futex 1230 futex_time64 -futex_waitv +futex_waitv 1473 futimesat 1285 get_kernel_syms get_mempolicy 1260 diff --git a/src/basic/syscalls-loongarch64.txt b/src/basic/syscalls-loongarch64.txt index e14e19fe19..8b10af64db 100644 --- a/src/basic/syscalls-loongarch64.txt +++ b/src/basic/syscalls-loongarch64.txt @@ -106,6 +106,7 @@ ftruncate 46 ftruncate64 futex 98 futex_time64 +futex_waitv 449 futimesat get_kernel_syms get_mempolicy 236 diff --git a/src/basic/syscalls-m68k.txt b/src/basic/syscalls-m68k.txt index 39b7b6b0c1..ef7295db2f 100644 --- a/src/basic/syscalls-m68k.txt +++ b/src/basic/syscalls-m68k.txt @@ -106,7 +106,7 @@ ftruncate 93 ftruncate64 194 futex 235 futex_time64 422 -futex_waitv +futex_waitv 449 futimesat 292 get_kernel_syms 130 get_mempolicy 269 diff --git a/src/basic/syscalls-mips64.txt b/src/basic/syscalls-mips64.txt index f558345e94..1f7ff567be 100644 --- a/src/basic/syscalls-mips64.txt +++ b/src/basic/syscalls-mips64.txt @@ -106,7 +106,7 @@ ftruncate 5075 ftruncate64 futex 5194 futex_time64 -futex_waitv +futex_waitv 5449 futimesat 5251 get_kernel_syms 5170 get_mempolicy 5228 diff --git a/src/basic/syscalls-mips64n32.txt b/src/basic/syscalls-mips64n32.txt index 3aebb159b8..7e1ad9637d 100644 --- a/src/basic/syscalls-mips64n32.txt +++ b/src/basic/syscalls-mips64n32.txt @@ -106,7 +106,7 @@ ftruncate 6075 ftruncate64 futex 6194 futex_time64 6422 -futex_waitv +futex_waitv 6449 futimesat 6255 get_kernel_syms 6170 get_mempolicy 6232 diff --git a/src/basic/syscalls-mipso32.txt b/src/basic/syscalls-mipso32.txt index 4a14b35dc4..c0c262fd1a 100644 --- a/src/basic/syscalls-mipso32.txt +++ b/src/basic/syscalls-mipso32.txt @@ -106,7 +106,7 @@ ftruncate 4093 ftruncate64 4212 futex 4238 futex_time64 4422 -futex_waitv +futex_waitv 4449 futimesat 4292 get_kernel_syms 4130 get_mempolicy 4269 diff --git a/src/basic/syscalls-powerpc.txt b/src/basic/syscalls-powerpc.txt index a9bdd9ad8f..2f085161e1 100644 --- a/src/basic/syscalls-powerpc.txt +++ b/src/basic/syscalls-powerpc.txt @@ -106,7 +106,7 @@ ftruncate 93 ftruncate64 194 futex 221 futex_time64 422 -futex_waitv +futex_waitv 449 futimesat 290 get_kernel_syms 130 get_mempolicy 260 diff --git a/src/basic/syscalls-powerpc64.txt b/src/basic/syscalls-powerpc64.txt index c267c04a06..85e53422ee 100644 --- a/src/basic/syscalls-powerpc64.txt +++ b/src/basic/syscalls-powerpc64.txt @@ -106,7 +106,7 @@ ftruncate 93 ftruncate64 futex 221 futex_time64 -futex_waitv +futex_waitv 449 futimesat 290 get_kernel_syms 130 get_mempolicy 260 diff --git a/src/basic/syscalls-s390.txt b/src/basic/syscalls-s390.txt index d56fd524ce..a25093c7be 100644 --- a/src/basic/syscalls-s390.txt +++ b/src/basic/syscalls-s390.txt @@ -106,7 +106,7 @@ ftruncate 93 ftruncate64 194 futex 238 futex_time64 422 -futex_waitv +futex_waitv 449 futimesat 292 get_kernel_syms 130 get_mempolicy 269 diff --git a/src/basic/syscalls-s390x.txt b/src/basic/syscalls-s390x.txt index b31acb673e..b4b798f9df 100644 --- a/src/basic/syscalls-s390x.txt +++ b/src/basic/syscalls-s390x.txt @@ -106,7 +106,7 @@ ftruncate 93 ftruncate64 futex 238 futex_time64 -futex_waitv +futex_waitv 449 futimesat 292 get_kernel_syms 130 get_mempolicy 269 diff --git a/src/basic/syscalls-sparc.txt b/src/basic/syscalls-sparc.txt index 8fdf3b3594..a382e75c24 100644 --- a/src/basic/syscalls-sparc.txt +++ b/src/basic/syscalls-sparc.txt @@ -106,7 +106,7 @@ ftruncate 130 ftruncate64 84 futex 142 futex_time64 422 -futex_waitv +futex_waitv 449 futimesat 288 get_kernel_syms 223 get_mempolicy 304 From d96ad9e8cb9fc8a9adfeebf69a645b809705daa0 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 3 Jan 2022 03:44:50 +0900 Subject: [PATCH 2/3] missing-syscall: add __NR_openat2 --- src/basic/missing_syscall_def.h | 66 +++++++++++++++++++++++++++++++++ src/basic/missing_syscalls.py | 1 + 2 files changed, 67 insertions(+) diff --git a/src/basic/missing_syscall_def.h b/src/basic/missing_syscall_def.h index 84d41d9fd3..d078bf70df 100644 --- a/src/basic/missing_syscall_def.h +++ b/src/basic/missing_syscall_def.h @@ -700,6 +700,72 @@ assert_cc(__NR_open_tree == systemd_NR_open_tree); # endif #endif +#ifndef __IGNORE_openat2 +# if defined(__aarch64__) +# define systemd_NR_openat2 437 +# elif defined(__alpha__) +# define systemd_NR_openat2 547 +# elif defined(__arc__) || defined(__tilegx__) +# define systemd_NR_openat2 437 +# elif defined(__arm__) +# define systemd_NR_openat2 437 +# elif defined(__i386__) +# define systemd_NR_openat2 437 +# elif defined(__ia64__) +# define systemd_NR_openat2 1461 +# elif defined(__loongarch64) +# define systemd_NR_openat2 437 +# elif defined(__m68k__) +# define systemd_NR_openat2 437 +# elif defined(_MIPS_SIM) +# if _MIPS_SIM == _MIPS_SIM_ABI32 +# define systemd_NR_openat2 4437 +# elif _MIPS_SIM == _MIPS_SIM_NABI32 +# define systemd_NR_openat2 6437 +# elif _MIPS_SIM == _MIPS_SIM_ABI64 +# define systemd_NR_openat2 5437 +# else +# error "Unknown MIPS ABI" +# endif +# elif defined(__powerpc__) +# define systemd_NR_openat2 437 +# elif defined(__riscv) +# if __riscv_xlen == 32 +# define systemd_NR_openat2 437 +# elif __riscv_xlen == 64 +# define systemd_NR_openat2 437 +# else +# error "Unknown RISC-V ABI" +# endif +# elif defined(__s390__) +# define systemd_NR_openat2 437 +# elif defined(__sparc__) +# define systemd_NR_openat2 437 +# elif defined(__x86_64__) +# if defined(__ILP32__) +# define systemd_NR_openat2 (437 | /* __X32_SYSCALL_BIT */ 0x40000000) +# else +# define systemd_NR_openat2 437 +# endif +# elif !defined(missing_arch_template) +# warning "openat2() syscall number is unknown for your architecture" +# endif + +/* may be an (invalid) negative number due to libseccomp, see PR 13319 */ +# if defined __NR_openat2 && __NR_openat2 >= 0 +# if defined systemd_NR_openat2 +assert_cc(__NR_openat2 == systemd_NR_openat2); +# endif +# else +# if defined __NR_openat2 +# undef __NR_openat2 +# endif +# if defined systemd_NR_openat2 && systemd_NR_openat2 >= 0 +# define __NR_openat2 systemd_NR_openat2 +# endif +# endif +#endif + #ifndef __IGNORE_pidfd_open # if defined(__aarch64__) # define systemd_NR_pidfd_open 434 diff --git a/src/basic/missing_syscalls.py b/src/basic/missing_syscalls.py index 1fbd619789..2694e83b98 100644 --- a/src/basic/missing_syscalls.py +++ b/src/basic/missing_syscalls.py @@ -16,6 +16,7 @@ SYSCALLS = [ 'move_mount', 'name_to_handle_at', 'open_tree', + 'openat2', 'pidfd_open', 'pidfd_send_signal', 'pkey_mprotect', From e83156c264d149e8f92f05b4d777317824a430f1 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 3 Jan 2022 03:47:27 +0900 Subject: [PATCH 3/3] seccomp-util: include missing_syscall_def.h to make __SNR_foo mapped to __NR_foo Fixes #21969. --- src/shared/seccomp-util.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index 7d2c52e188..b70ad1f7ea 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -3,13 +3,16 @@ #include #include #include -#include #include #include #include #include #include +/* include missing_syscall_def.h earlier to make __SNR_foo mapped to __NR_foo. */ +#include "missing_syscall_def.h" +#include + #include "af-list.h" #include "alloc-util.h" #include "env-util.h" @@ -1736,13 +1739,11 @@ int seccomp_memory_deny_write_execute(void) { if (r < 0) continue; -#ifdef __NR_pkey_mprotect r = add_seccomp_syscall_filter(seccomp, arch, SCMP_SYS(pkey_mprotect), 1, SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC, PROT_EXEC)); if (r < 0) continue; -#endif if (shmat_syscall > 0) { r = add_seccomp_syscall_filter(seccomp, arch, shmat_syscall, @@ -2063,7 +2064,6 @@ static int seccomp_restrict_sxid(scmp_filter_ctx seccomp, mode_t m) { else any = true; -#if SCMP_SYS(open) > 0 r = seccomp_rule_add_exact( seccomp, SCMP_ACT_ERRNO(EPERM), @@ -2075,7 +2075,6 @@ static int seccomp_restrict_sxid(scmp_filter_ctx seccomp, mode_t m) { log_debug_errno(r, "Failed to add filter for open: %m"); else any = true; -#endif r = seccomp_rule_add_exact( seccomp, @@ -2213,7 +2212,6 @@ static int block_open_flag(scmp_filter_ctx seccomp, int flag) { /* Blocks open() with the specified flag, where flag is O_SYNC or so. This makes these calls return * EINVAL, in the hope the client code will retry without O_SYNC then. */ -#if SCMP_SYS(open) > 0 r = seccomp_rule_add_exact( seccomp, SCMP_ACT_ERRNO(EINVAL), @@ -2224,7 +2222,6 @@ static int block_open_flag(scmp_filter_ctx seccomp, int flag) { log_debug_errno(r, "Failed to add filter for open: %m"); else any = true; -#endif r = seccomp_rule_add_exact( seccomp,