proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-14 07:47:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #2965 from brauner/2019-05-01/seccomp_notifier_fixes

Browse Source 
seccomp: notifier fixes
This commit is contained in:
Stéphane Graber 2019-04-30 18:53:21 -04:00 committed by GitHub
commit 0b8bb8db54
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 48 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/lxc/af_unix.c
View File

@ -365,18 +365,23 @@ int lxc_unix_connect(struct sockaddr_un *addr)
int ret; int ret;
ssize_t len; ssize_t len;
fd = socket(PF_UNIX, SOCK_STREAM, SOCK_CLOEXEC); fd = socket(AF_UNIX, SOCK_STREAM, 0);
if (fd < 0) if (fd < 0) {
SYSERROR("Failed to open new AF_UNIX socket");
return -1; return -1;
}
if (addr->sun_path[0] == '\0') if (addr->sun_path[0] == '\0')
len = strlen(&addr->sun_path[1]); len = strlen(&addr->sun_path[1]);
else else
len = strlen(&addr->sun_path[0]); len = strlen(&addr->sun_path[0]);
ret = connect(fd, (struct sockaddr *)&addr,
offsetof(struct sockaddr_un, sun_path) + len + 1); ret = connect(fd, (struct sockaddr *)addr,
if (ret < 0) offsetof(struct sockaddr_un, sun_path) + len);
if (ret < 0) {
SYSERROR("Failed to bind new AF_UNIX socket");
return -1; return -1;
}
return move_fd(fd); return move_fd(fd);
} }

14
src/lxc/attach.c
View File

@ -1317,13 +1317,15 @@ int lxc_attach(const char *name, const char *lxcpath,
TRACE("Sent LSM label file descriptor %d to child", labelfd); TRACE("Sent LSM label file descriptor %d to child", labelfd);
} }
ret = lxc_seccomp_recv_notifier_fd(&conf->seccomp, ipc_sockets[0]); if (conf && conf->seccomp.seccomp) {
if (ret < 0) ret = lxc_seccomp_recv_notifier_fd(&conf->seccomp, ipc_sockets[0]);
goto close_mainloop; if (ret < 0)
goto close_mainloop;
ret = lxc_seccomp_add_notifier(name, lxcpath, &conf->seccomp); ret = lxc_seccomp_add_notifier(name, lxcpath, &conf->seccomp);
if (ret < 0) if (ret < 0)
goto close_mainloop; goto close_mainloop;
}
/* We're done, the child process should now execute whatever it /* We're done, the child process should now execute whatever it
* is that the user requested. The parent can now track it with * is that the user requested. The parent can now track it with

12
src/lxc/lxcseccomp.h
View File

@ -79,9 +79,9 @@ extern void lxc_seccomp_free(struct lxc_seccomp *seccomp);
extern int seccomp_notify_handler(int fd, uint32_t events, void *data, extern int seccomp_notify_handler(int fd, uint32_t events, void *data,
struct lxc_epoll_descr *descr); struct lxc_epoll_descr *descr);
extern void seccomp_conf_init(struct lxc_conf *conf); extern void seccomp_conf_init(struct lxc_conf *conf);
extern int lxc_seccomp_setup_notifier(struct lxc_seccomp *seccomp, extern int lxc_seccomp_setup_proxy(struct lxc_seccomp *seccomp,
struct lxc_epoll_descr *descr, struct lxc_epoll_descr *descr,
struct lxc_handler *handler); struct lxc_handler *handler);
extern int lxc_seccomp_send_notifier_fd(struct lxc_seccomp *seccomp, extern int lxc_seccomp_send_notifier_fd(struct lxc_seccomp *seccomp,
int socket_fd); int socket_fd);
extern int lxc_seccomp_recv_notifier_fd(struct lxc_seccomp *seccomp, extern int lxc_seccomp_recv_notifier_fd(struct lxc_seccomp *seccomp,
@ -129,9 +129,9 @@ static inline void seccomp_conf_init(struct lxc_conf *conf)
{ {
} }
static inline int lxc_seccomp_setup_notifier(struct lxc_seccomp *seccomp, static inline int lxc_seccomp_setup_proxy(struct lxc_seccomp *seccomp,
struct lxc_epoll_descr *descr, struct lxc_epoll_descr *descr,
struct lxc_handler *handler) struct lxc_handler *handler)
{ {
return 0; return 0;
} }

37
src/lxc/seccomp.c
View File

@ -1410,9 +1410,9 @@ void seccomp_conf_init(struct lxc_conf *conf)
#endif #endif
} }
int lxc_seccomp_setup_notifier(struct lxc_seccomp *seccomp, int lxc_seccomp_setup_proxy(struct lxc_seccomp *seccomp,
struct lxc_epoll_descr *descr, struct lxc_epoll_descr *descr,
struct lxc_handler *handler) struct lxc_handler *handler)
{ {
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIF_GET_FD
if (seccomp->notifier.wants_supervision && if (seccomp->notifier.wants_supervision &&
@ -1421,20 +1421,32 @@ int lxc_seccomp_setup_notifier(struct lxc_seccomp *seccomp,
int ret; int ret;
notify_fd = lxc_unix_connect(&seccomp->notifier.proxy_addr); notify_fd = lxc_unix_connect(&seccomp->notifier.proxy_addr);
if (notify_fd < 0) if (notify_fd < 0) {
SYSERROR("Failed to connect to seccomp proxy");
return -1; return -1;
}
/* 30 second timeout */ /* 30 second timeout */
ret = lxc_socket_set_timeout(notify_fd, 30, 30); ret = lxc_socket_set_timeout(notify_fd, 30, 30);
if (ret) if (ret) {
SYSERROR("Failed to set timeouts for seccomp proxy");
return -1; return -1;
}
ret = seccomp_notif_alloc(&seccomp->notifier.req_buf,
&seccomp->notifier.rsp_buf);
if (ret) {
ERROR("Failed to allocate seccomp notify request and response buffers");
errno = ret;
return -1;
}
ret = lxc_mainloop_add_handler(descr, ret = lxc_mainloop_add_handler(descr,
seccomp->notifier.notify_fd, seccomp->notifier.notify_fd,
seccomp_notify_handler, handler); seccomp_notify_handler, handler);
if (ret < 0) { if (ret < 0) {
ERROR("Failed to add seccomp notify handler for %d to mainloop", ERROR("Failed to add seccomp notify handler for %d to mainloop",
seccomp->notifier.notify_fd); notify_fd);
return -1; return -1;
} }
@ -1469,15 +1481,6 @@ int lxc_seccomp_recv_notifier_fd(struct lxc_seccomp *seccomp, int socket_fd)
1, NULL, 0); 1, NULL, 0);
if (ret < 0) if (ret < 0)
return -1; return -1;
if (seccomp->notifier.proxy_fd >= 0) {
ret = seccomp_notif_alloc(&seccomp->notifier.req_buf,
&seccomp->notifier.rsp_buf);
if (ret) {
errno = ret;
return -1;
}
}
} }
#endif #endif
return 0; return 0;
@ -1488,11 +1491,11 @@ int lxc_seccomp_add_notifier(const char *name, const char *lxcpath,
{ {
#if HAVE_DECL_SECCOMP_NOTIF_GET_FD #if HAVE_DECL_SECCOMP_NOTIF_GET_FD
if (seccomp->notifier.proxy_fd >= 0) { if (seccomp->notifier.wants_supervision) {
int ret; int ret;
ret = lxc_cmd_seccomp_notify_add_listener(name, lxcpath, ret = lxc_cmd_seccomp_notify_add_listener(name, lxcpath,
seccomp->notifier.notify_fd, seccomp->notifier.notify_fd,
-1, 0); -1, 0);
close_prot_errno_disarm(seccomp->notifier.notify_fd); close_prot_errno_disarm(seccomp->notifier.notify_fd);
if (ret < 0) if (ret < 0)

6
src/lxc/start.c
View File

@ -591,9 +591,11 @@ int lxc_poll(const char *name, struct lxc_handler *handler)
goto out_mainloop_console; goto out_mainloop_console;
} }
ret = lxc_seccomp_setup_notifier(&handler->conf->seccomp, &descr, handler); ret = lxc_seccomp_setup_proxy(&handler->conf->seccomp, &descr, handler);
if (ret < 0) if (ret < 0) {
ERROR("Failed to setup seccomp proxy");
goto out_mainloop_console; goto out_mainloop_console;
}
if (has_console) { if (has_console) {
struct lxc_terminal *console = &handler->conf->console; struct lxc_terminal *console = &handler->conf->console;