SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dlopen: take log_level argument and log in fallback stubs

Browse Source 
Every dlopen_xxx() helper now takes an int log_level argument. It is
passed through to dlopen_many_sym_or_warn() (which in turn propagates it
to dlopen_verbose() for the library-not-installed case), and is used by
the fallback stub when support for the library is not compiled in to
emit a "<lib> support is not compiled in." message at the caller's level.
Callers pass LOG_DEBUG when gracefully degrading, or a higher level when
the failure should surface, and no longer need to log redundantly at the
call site.

As part of this, dlopen_bpf_full() (which already took a log_level) is
merged into dlopen_bpf() rather than keeping both.

The static inline fallbacks used to live in the headers, which required
pulling log.h in from every header that declared a dlopen_xxx(). Move
them into the .c files instead: the declaration is always outside the
#if HAVE_XXX block, the impl sits outside the outer #if HAVE_XXX wrap
with its own internal #if HAVE_XXX/#else/#endif, and apparmor-util.c,
idn-util.c, libmount-util.c and pam-util.c are now always compiled so
they can host their stubs.
This commit is contained in:
Daan De Meyer
2026-04-22 17:41:42 +02:00
committed by Zbigniew Jędrzejewski-Szmek
parent 2d28d3cb91
commit d49f3f287a
112 changed files with 796 additions and 755 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/seccomp-util.c
+49 -44
View File
@@ -50,32 +50,6 @@ DLSYM_PROTOTYPE(seccomp_rule_add_exact) = NULL;
DLSYM_PROTOTYPE(seccomp_syscall_resolve_name) = NULL;
DLSYM_PROTOTYPE(seccomp_syscall_resolve_num_arch) = NULL;
int dlopen_libseccomp(void) {
SD_ELF_NOTE_DLOPEN(
"seccomp",
"Support for Seccomp Sandboxes",
SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED,
"libseccomp.so.2");
return dlopen_many_sym_or_warn(
&libseccomp_dl,
"libseccomp.so.2",
LOG_DEBUG,
DLSYM_ARG(seccomp_api_get),
DLSYM_ARG(seccomp_arch_add),
DLSYM_ARG(seccomp_arch_exist),
DLSYM_ARG(seccomp_arch_native),
DLSYM_ARG(seccomp_arch_remove),
DLSYM_ARG(seccomp_attr_set),
DLSYM_ARG(seccomp_init),
DLSYM_ARG(seccomp_load),
DLSYM_ARG(seccomp_release),
DLSYM_ARG(seccomp_rule_add_array),
DLSYM_ARG(seccomp_rule_add_exact),
DLSYM_ARG(seccomp_syscall_resolve_name),
DLSYM_ARG(seccomp_syscall_resolve_num_arch));
}
/* This array will be modified at runtime as seccomp_restrict_archs is called. */
uint32_t seccomp_local_archs[] = {
@@ -283,7 +257,7 @@ int seccomp_init_for_arch(scmp_filter_ctx *ret, uint32_t arch, uint32_t default_
/* Much like seccomp_init(), but initializes the filter for one specific architecture only, without affecting
* any others. Also, turns off the NNP fiddling. */
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -343,7 +317,7 @@ bool is_seccomp_available(void) {
static int cached_enabled = -1;
if (cached_enabled < 0) {
if (dlopen_libseccomp() < 0)
if (dlopen_libseccomp(LOG_DEBUG) < 0)
return (cached_enabled = false);
int b = secure_getenv_bool("SYSTEMD_SECCOMP");
@@ -1093,7 +1067,7 @@ int seccomp_add_syscall_filter_item(
} else {
int id, r;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -1173,7 +1147,7 @@ int seccomp_load_syscall_filter_set(uint32_t default_action, const SyscallFilter
/* The one-stop solution: allocate a seccomp object, add the specified filter to it, and apply it. Once for
* each local arch. */
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -1239,7 +1213,7 @@ int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* filter
if (hashmap_isempty(filter) && default_action == SCMP_ACT_ALLOW)
return 0;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -1362,7 +1336,7 @@ int seccomp_parse_syscall_filter(
} else {
int id;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0) {
if (!FLAGS_SET(flags, SECCOMP_PARSE_PERMISSIVE))
return r;
@@ -1420,7 +1394,7 @@ int seccomp_restrict_namespaces(unsigned long retain) {
if (FLAGS_SET(retain, NAMESPACE_FLAGS_ALL))
return 0;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -1548,7 +1522,7 @@ int seccomp_protect_sysctl(void) {
uint32_t arch;
int r;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -1600,7 +1574,7 @@ int seccomp_protect_syslog(void) {
uint32_t arch;
int r;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -1637,7 +1611,7 @@ int seccomp_restrict_address_families(Set *address_families, bool allow_list) {
uint32_t arch;
int r;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -1823,7 +1797,7 @@ int seccomp_restrict_realtime_full(int error_code) {
assert(error_code > 0);
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -1928,7 +1902,7 @@ int seccomp_memory_deny_write_execute(void) {
unsigned loaded = 0;
int r;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -2048,7 +2022,7 @@ int seccomp_restrict_archs(Set *archs) {
int r;
bool blocked_new = false;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -2141,7 +2115,7 @@ int seccomp_filter_set_add_by_name(Hashmap *filter, bool add, const char *name)
assert(filter);
assert(name);
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -2190,7 +2164,7 @@ int seccomp_lock_personality(unsigned long personality) {
if (personality >= PERSONALITY_INVALID)
return -EINVAL;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -2228,7 +2202,7 @@ int seccomp_protect_hostname(void) {
uint32_t arch;
int r;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -2444,7 +2418,7 @@ int seccomp_restrict_suid_sgid(void) {
uint32_t arch;
int r, k;
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -2571,7 +2545,7 @@ int seccomp_suppress_sync(void) {
*
* Additionally, O_SYNC/O_DSYNC are masked. */
r = dlopen_libseccomp();
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return r;
@@ -2628,6 +2602,37 @@ int seccomp_suppress_sync(void) {
#endif
int dlopen_libseccomp(int log_level) {
#if HAVE_SECCOMP
SD_ELF_NOTE_DLOPEN(
"seccomp",
"Support for Seccomp Sandboxes",
SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED,
"libseccomp.so.2");
return dlopen_many_sym_or_warn(
&libseccomp_dl,
"libseccomp.so.2",
log_level,
DLSYM_ARG(seccomp_api_get),
DLSYM_ARG(seccomp_arch_add),
DLSYM_ARG(seccomp_arch_exist),
DLSYM_ARG(seccomp_arch_native),
DLSYM_ARG(seccomp_arch_remove),
DLSYM_ARG(seccomp_attr_set),
DLSYM_ARG(seccomp_init),
DLSYM_ARG(seccomp_load),
DLSYM_ARG(seccomp_release),
DLSYM_ARG(seccomp_rule_add_array),
DLSYM_ARG(seccomp_rule_add_exact),
DLSYM_ARG(seccomp_syscall_resolve_name),
DLSYM_ARG(seccomp_syscall_resolve_num_arch));
#else
return log_full_errno(log_level, SYNTHETIC_ERRNO(EOPNOTSUPP),
"libseccomp support is not compiled in.");
#endif
}
bool seccomp_errno_or_action_is_valid(int n) {
return n == SECCOMP_ERROR_NUMBER_KILL || errno_is_valid(n);
}