proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-07-27 12:37:35 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #2274 from brauner/2018-04-13/fix_seccomp_with_personality_and_64bit_kernel_32_bit_userspace

Browse Source 
seccomp: handle arch inversion
This commit is contained in:
Serge Hallyn 2018-04-13 10:29:18 -05:00 committed by GitHub
commit 2c80e9cf15
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 32 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/lxc/seccomp.c
View File

@ -370,6 +370,8 @@ scmp_filter_ctx get_new_ctx(enum lxc_hostarch_t n_arch, uint32_t default_policy_
WARN("Failed to turn on seccomp nop-skip, continuing"); WARN("Failed to turn on seccomp nop-skip, continuing");
} }
#endif #endif
if (seccomp_arch_exist(ctx, arch) == -EEXIST) {
ret = seccomp_arch_add(ctx, arch); ret = seccomp_arch_add(ctx, arch);
if (ret != 0) { if (ret != 0) {
ERROR("Seccomp error %d (%s) adding arch: %d", ret, ERROR("Seccomp error %d (%s) adding arch: %d", ret,
@ -377,11 +379,13 @@ scmp_filter_ctx get_new_ctx(enum lxc_hostarch_t n_arch, uint32_t default_policy_
seccomp_release(ctx); seccomp_release(ctx);
return NULL; return NULL;
} }
if (seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE) != 0) { if (seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE) != 0) {
ERROR("Seccomp error removing native arch"); ERROR("Seccomp error removing native arch");
seccomp_release(ctx); seccomp_release(ctx);
return NULL; return NULL;
} }
}
return ctx; return ctx;
} }
@ -772,12 +776,24 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
} }
if (compat_ctx[0]) { if (compat_ctx[0]) {
INFO("Merging in the compat Seccomp ctx into the main one"); INFO("Merging compat seccomp contexts into main context");
if (seccomp_merge(conf->seccomp_ctx, compat_ctx[0]) != 0 || if (compat_arch[0] != native_arch && compat_arch[0] != seccomp_arch_native()) {
(compat_ctx[1] != NULL && seccomp_merge(conf->seccomp_ctx, compat_ctx[1]) != 0)) { ret = seccomp_merge(conf->seccomp_ctx, compat_ctx[0]);
ERROR("Error merging compat Seccomp contexts"); if (ret < 0) {
ERROR("Failed to merge first compat seccomp context into main context");
goto bad; goto bad;
} }
TRACE("Merged first compat seccomp context into main context");
}
if (compat_arch[1] && compat_arch[1] != native_arch && compat_arch[1] != seccomp_arch_native()) {
ret = seccomp_merge(conf->seccomp_ctx, compat_ctx[1]);
if (ret < 0) {
ERROR("Failed to merge first compat seccomp context into main context");
goto bad;
}
TRACE("Merged second compat seccomp context into main context");
}
} }
return 0; return 0;