From 62a0680bf2cf010c899da65b561bdf07a148f763 Mon Sep 17 00:00:00 2001 From: Alan Jenkins Date: Wed, 31 Jan 2018 15:39:13 +0000 Subject: [PATCH 1/2] man: systemd.exec: cleanup "only X will be permitted" ... "but X=X+1" > Only system calls of the *specified* architectures will be permitted to > processes of this unit. (my emphasis) > Note that setting this option to a non-empty list implies that > native is included too. Attempting to use "implies" in the later sentence, in a way that contradicts the very clear meaning of the earlier sentence... it's too much. --- man/systemd.exec.xml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 2f62f1cd6b..fc3b9ffd16 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1429,15 +1429,15 @@ CapabilityBoundingSet=~CAP_B CAP_C filter. The known architecture identifiers are the same as for ConditionArchitecture= described in systemd.unit5, as well as x32, mips64-n32, mips64-le-n32, and - the special identifier native. Only system calls of the specified architectures will be - permitted to processes of this unit. This is an effective way to disable compatibility with non-native - architectures for processes, for example to prohibit execution of 32-bit x86 binaries on 64-bit x86-64 - systems. The special native identifier implicitly maps to the native architecture of the - system (or more strictly: to the architecture the system manager is compiled for). If running in user mode, or - in system mode, but without the CAP_SYS_ADMIN capability (e.g. setting - User=nobody), NoNewPrivileges=yes is implied. Note that setting this - option to a non-empty list implies that native is included too. By default, this option is - set to the empty list, i.e. no system call architecture filtering is applied. + the special identifier native. If this setting is used, processes of this unit will only + be permitted to call native system calls, and system calls of the specified architectures. This is an + effective way to disable compatibility with non-native architectures for processes, for example to prohibit + execution of 32-bit x86 binaries on 64-bit x86-64 systems. The special native identifier + implicitly maps to the native architecture of the system (or more precisely: to the architecture the system + manager is compiled for). If running in user mode, or in system mode, but without the + CAP_SYS_ADMIN capability (e.g. setting User=nobody), + NoNewPrivileges=yes is implied. By default, this option is set to the empty list, i.e. no + system call architecture filtering is applied. Note that system call filtering is not equally effective on all architectures. For example, on x86 filtering of network socket-related calls is not possible, due to ABI limitations — a limitation that x86-64 From 5c19ff79de0cde873de7122f4cf417c7c3012c1a Mon Sep 17 00:00:00 2001 From: Alan Jenkins Date: Wed, 31 Jan 2018 17:11:47 +0000 Subject: [PATCH 2/2] seccomp-util: fix alarming debug message (#8002, #8001) Booting with `systemd.log_level=debug` and looking in `dmesg -u` showed messages like this: systemd[433]: Failed to add rule for system call n/a() / 156, ignoring: Numerical argument out of domain This commit fixes it to: systemd[449]: Failed to add rule for system call _sysctl() / 156, ignoring: Numerical argument out of domain Some of the messages could be even more misleading, e.g. we were reporting that utimensat() / 320 was skipped as non-existent on x86, when actually the syscall number 320 is kexec_file_load() on x86 . The problem was that syscall NRs are looked up (and correctly passed to libseccomp) as native syscall NRs. But we forgot that when we tried to go back from the syscall NR to the name. I think the natural way to write this would be seccomp_syscall_resolve_num(nr), however there is no such function. I couldn't work out a short comment that would make this clearer. FWIW I wrote it up as a ticket for libseccomp instead. https://github.com/seccomp/libseccomp/issues/104 --- src/shared/seccomp-util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index fbb232cd45..e4bc803132 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -935,7 +935,7 @@ int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* set, u /* If the system call is not known on this architecture, then that's fine, let's ignore it */ _cleanup_free_ char *n = NULL; - n = seccomp_syscall_resolve_num_arch(arch, PTR_TO_INT(id) - 1); + n = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1); log_debug_errno(r, "Failed to add rule for system call %s() / %d, ignoring: %m", strna(n), PTR_TO_INT(id) - 1); } }