proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-14 07:47:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

seccomp: set SCMP_FLTATR_ATL_TSKIP if available

Browse Source 
Newer libseccomp has a flag called SCMP_FLTATR_ATL_TSKIP which
allows syscall '-1' (nop) to be executed.  Without that flag,
debuggers cannot skip system calls inside containers.  For reference,
see the seccomp(2) manpage, which says:

	The tracer can skip the system call by changing the system call  number  to  -1.

and see the seccomp issue #80

Signed-off-by: Serge Hallyn <serge@hallyn.com>
This commit is contained in:
Serge Hallyn 2017-03-06 13:36:19 -06:00
parent 81e4574cc2
commit 127c52930b
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/lxc/seccomp.c
View File

@ -221,6 +221,11 @@ scmp_filter_ctx get_new_ctx(enum lxc_hostarch_t n_arch, uint32_t default_policy_
seccomp_release(ctx); seccomp_release(ctx);
return NULL; return NULL;
} }
#ifdef SCMP_FLTATR_ATL_TSKIP
if (seccomp_attr_set(ctx, SCMP_FLTATR_ATL_TSKIP, 1)) {
WARN("Failed to turn on seccomp nop-skip, continuing");
}
#endif
ret = seccomp_arch_add(ctx, arch); ret = seccomp_arch_add(ctx, arch);
if (ret != 0) { if (ret != 0) {
ERROR("Seccomp error %d (%s) adding arch: %d", ret, ERROR("Seccomp error %d (%s) adding arch: %d", ret,
@ -396,6 +401,11 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
ERROR("Failed to turn off n-new-privs."); ERROR("Failed to turn off n-new-privs.");
return -1; return -1;
} }
#ifdef SCMP_FLTATR_ATL_TSKIP
if (seccomp_attr_set(conf->seccomp_ctx, SCMP_FLTATR_ATL_TSKIP, 1)) {
WARN("Failed to turn on seccomp nop-skip, continuing");
}
#endif
} }
while (fgets(line, 1024, f)) { while (fgets(line, 1024, f)) {
@ -717,7 +727,7 @@ int lxc_read_seccomp_config(struct lxc_conf *conf)
return -1; return -1;
} }
/* turn of no-new-privs. We don't want it in lxc, and it breaks /* turn off no-new-privs. We don't want it in lxc, and it breaks
* with apparmor */ * with apparmor */
#if HAVE_SCMP_FILTER_CTX #if HAVE_SCMP_FILTER_CTX
check_seccomp_attr_set = seccomp_attr_set(conf->seccomp_ctx, SCMP_FLTATR_CTL_NNP, 0); check_seccomp_attr_set = seccomp_attr_set(conf->seccomp_ctx, SCMP_FLTATR_CTL_NNP, 0);
@ -728,6 +738,11 @@ int lxc_read_seccomp_config(struct lxc_conf *conf)
ERROR("Failed to turn off n-new-privs."); ERROR("Failed to turn off n-new-privs.");
return -1; return -1;
} }
#ifdef SCMP_FLTATR_ATL_TSKIP
if (seccomp_attr_set(conf->seccomp_ctx, SCMP_FLTATR_ATL_TSKIP, 1)) {
WARN("Failed to turn on seccomp nop-skip, continuing");
}
#endif
f = fopen(conf->seccomp, "r"); f = fopen(conf->seccomp, "r");
if (!f) { if (!f) {