From 6da432fd542af5553742b905a0f87a825a28a399 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 18 Aug 2020 16:10:47 +0200 Subject: [PATCH 1/2] shared/seccomp: do not use ifdef guards around textual syscall names It is possible that we will be running with an upgraded libseccomp, in which case libseccomp might know the syscall name, even if the number is not known at the time when systemd is being compiled. The guard only serves to break such upgrades, by requiring that we also recompile systemd. For s390-specific syscalls, use a define to exclude them, so that that we don't try to filter them on other arches. (cherry picked from commit 6cf852e79eb0eced2f77653941f9c75c3bd79386) --- src/shared/seccomp-util.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index 45bf309bcf..99585924a0 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -387,7 +387,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "pidfd_getfd\0" "ptrace\0" "rtas\0" -#ifdef __NR_s390_runtime_instr +#if defined __s390__ || defined __s390x__ "s390_runtime_instr\0" #endif "sys_debug_setcontext\0" @@ -464,9 +464,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "stat64\0" "statfs\0" "statfs64\0" -#ifdef __NR_statx "statx\0" -#endif "symlink\0" "symlinkat\0" "truncate\0" @@ -712,10 +710,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "pciconfig_iobase\0" "pciconfig_read\0" "pciconfig_write\0" -#ifdef __NR_s390_pci_mmio_read +#if defined __s390__ || defined __s390x__ "s390_pci_mmio_read\0" -#endif -#ifdef __NR_s390_pci_mmio_write "s390_pci_mmio_write\0" #endif }, From b4eaa6cc99d7fb68902c76115ca80c95165e6c4f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 18 Aug 2020 17:06:28 +0200 Subject: [PATCH 2/2] shared/seccomp: use _cleanup_ in one more place (cherry picked from commit 27605d6a836d85563faf41db9f7a72883d44c0ff) --- src/nspawn/nspawn-seccomp.h | 2 +- src/shared/seccomp-util.c | 16 ++++++---------- 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/src/nspawn/nspawn-seccomp.h b/src/nspawn/nspawn-seccomp.h index 4174323520..6a48e6459b 100644 --- a/src/nspawn/nspawn-seccomp.h +++ b/src/nspawn/nspawn-seccomp.h @@ -3,4 +3,4 @@ #include -int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_ist, char **syscall_deny_list); +int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_list, char **syscall_deny_list); diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index 99585924a0..4dee044810 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -187,7 +187,7 @@ int seccomp_arch_from_string(const char *n, uint32_t *ret) { } int seccomp_init_for_arch(scmp_filter_ctx *ret, uint32_t arch, uint32_t default_action) { - scmp_filter_ctx seccomp; + _cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL; int r; /* Much like seccomp_init(), but initializes the filter for one specific architecture only, without affecting @@ -202,11 +202,11 @@ int seccomp_init_for_arch(scmp_filter_ctx *ret, uint32_t arch, uint32_t default_ r = seccomp_arch_remove(seccomp, seccomp_arch_native()); if (r < 0) - goto finish; + return r; r = seccomp_arch_add(seccomp, arch); if (r < 0) - goto finish; + return r; assert(seccomp_arch_exist(seccomp, arch) >= 0); assert(seccomp_arch_exist(seccomp, SCMP_ARCH_NATIVE) == -EEXIST); @@ -218,18 +218,14 @@ int seccomp_init_for_arch(scmp_filter_ctx *ret, uint32_t arch, uint32_t default_ r = seccomp_attr_set(seccomp, SCMP_FLTATR_ACT_BADARCH, SCMP_ACT_ALLOW); if (r < 0) - goto finish; + return r; r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0); if (r < 0) - goto finish; + return r; - *ret = seccomp; + *ret = TAKE_PTR(seccomp); return 0; - -finish: - seccomp_release(seccomp); - return r; } static bool is_basic_seccomp_available(void) {