SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #29618 from bonktree/fchmodat2

Browse Source 
seccomp: get `fchmodat2(2)` covered by `RestrictSUIDSGID=`
This commit is contained in:
Luca Boccassi
2023-10-20 10:49:46 +01:00
committed by GitHub
parent 612a91c11a 8b45281daa
commit ed51ccf4b8
25 changed files with 164 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/seccomp-util.c
+25 -2
View File
@@ -478,6 +478,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
"fchdir\0"
"fchmod\0"
"fchmodat\0"
"fchmodat2\0"
"fcntl\0"
"fcntl64\0"
"fgetxattr\0"
@@ -2080,7 +2081,7 @@ int seccomp_protect_hostname(void) {
static int seccomp_restrict_sxid(scmp_filter_ctx seccomp, mode_t m) {
/* Checks the mode_t parameter of the following system calls:
*
* → chmod() + fchmod() + fchmodat()
* → chmod() + fchmod() + fchmodat() + fchmodat2()
* → open() + creat() + openat()
* → mkdir() + mkdirat()
* → mknod() + mknodat()
@@ -2123,6 +2124,28 @@ static int seccomp_restrict_sxid(scmp_filter_ctx seccomp, mode_t m) {
else
any = true;
#if defined(__SNR_fchmodat2)
r = seccomp_rule_add_exact(
seccomp,
SCMP_ACT_ERRNO(EPERM),
SCMP_SYS(fchmodat2),
1,
SCMP_A2(SCMP_CMP_MASKED_EQ, m, m));
#else
/* It looks like this libseccomp does not know about fchmodat2().
* Pretend the fchmodat2() system call is not supported at all,
* regardless of the kernel version. */
r = seccomp_rule_add_exact(
seccomp,
SCMP_ACT_ERRNO(ENOSYS),
__NR_fchmodat2,
0);
#endif
if (r < 0)
log_debug_errno(r, "Failed to add filter for fchmodat2: %m");
else
any = true;
r = seccomp_rule_add_exact(
seccomp,
SCMP_ACT_ERRNO(EPERM),
@@ -2241,7 +2264,7 @@ int seccomp_restrict_suid_sgid(void) {
k = seccomp_restrict_sxid(seccomp, S_ISGID);
if (k < 0)
log_debug_errno(r, "Failed to add sgid rule for architecture %s, ignoring: %m",
log_debug_errno(k, "Failed to add sgid rule for architecture %s, ignoring: %m",
seccomp_arch_to_string(arch));
if (r < 0 && k < 0)