mirror of
https://github.com/systemd/systemd
synced 2024-10-15 12:34:37 +00:00
nspawn: part over seccomp code to use seccomp_add_syscall_filter_item()
Let's unify a bit of the code here.
This commit is contained in:
Lennart Poettering
parent
69b1b241bb
commit
402530d91e
|
|
@ -43,90 +43,88 @@ static int seccomp_add_default_syscall_filter(
|
|||
|
||||
static const struct {
|
||||
uint64_t capability;
|
||||
int syscall_num;
|
||||
const char* name;
|
||||
} blacklist[] = {
|
||||
{ 0, SCMP_SYS(_sysctl) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(add_key) }, /* keyring is not namespaced */
|
||||
{ 0, SCMP_SYS(afs_syscall) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(bdflush) },
|
||||
{ 0, "_sysctl" }, /* obsolete syscall */
|
||||
{ 0, "add_key" }, /* keyring is not namespaced */
|
||||
{ 0, "afs_syscall" }, /* obsolete syscall */
|
||||
{ 0, "bdflush" },
|
||||
#ifdef __NR_bpf
|
||||
{ 0, SCMP_SYS(bpf) },
|
||||
{ 0, "bpf" },
|
||||
#endif
|
||||
{ 0, SCMP_SYS(break) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(create_module) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(ftime) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(get_kernel_syms) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(getpmsg) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(gtty) }, /* obsolete syscall */
|
||||
{ 0, "break" }, /* obsolete syscall */
|
||||
{ 0, "create_module" }, /* obsolete syscall */
|
||||
{ 0, "ftime" }, /* obsolete syscall */
|
||||
{ 0, "get_kernel_syms" }, /* obsolete syscall */
|
||||
{ 0, "getpmsg" }, /* obsolete syscall */
|
||||
{ 0, "gtty" }, /* obsolete syscall */
|
||||
#ifdef __NR_kexec_file_load
|
||||
{ 0, SCMP_SYS(kexec_file_load) },
|
||||
{ 0, "kexec_file_load" },
|
||||
#endif
|
||||
{ 0, SCMP_SYS(kexec_load) },
|
||||
{ 0, SCMP_SYS(keyctl) }, /* keyring is not namespaced */
|
||||
{ 0, SCMP_SYS(lock) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(lookup_dcookie) },
|
||||
{ 0, SCMP_SYS(mpx) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(nfsservctl) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(open_by_handle_at) },
|
||||
{ 0, SCMP_SYS(perf_event_open) },
|
||||
{ 0, SCMP_SYS(prof) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(profil) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(putpmsg) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(query_module) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(quotactl) },
|
||||
{ 0, SCMP_SYS(request_key) }, /* keyring is not namespaced */
|
||||
{ 0, SCMP_SYS(security) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(sgetmask) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(ssetmask) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(stty) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(swapoff) },
|
||||
{ 0, SCMP_SYS(swapon) },
|
||||
{ 0, SCMP_SYS(sysfs) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(tuxcall) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(ulimit) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(uselib) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(ustat) }, /* obsolete syscall */
|
||||
{ 0, SCMP_SYS(vserver) }, /* obsolete syscall */
|
||||
{ CAP_SYSLOG, SCMP_SYS(syslog) },
|
||||
{ CAP_SYS_MODULE, SCMP_SYS(delete_module) },
|
||||
{ CAP_SYS_MODULE, SCMP_SYS(finit_module) },
|
||||
{ CAP_SYS_MODULE, SCMP_SYS(init_module) },
|
||||
{ CAP_SYS_PACCT, SCMP_SYS(acct) },
|
||||
{ CAP_SYS_PTRACE, SCMP_SYS(process_vm_readv) },
|
||||
{ CAP_SYS_PTRACE, SCMP_SYS(process_vm_writev) },
|
||||
{ CAP_SYS_PTRACE, SCMP_SYS(ptrace) },
|
||||
{ CAP_SYS_RAWIO, SCMP_SYS(ioperm) },
|
||||
{ CAP_SYS_RAWIO, SCMP_SYS(iopl) },
|
||||
{ CAP_SYS_RAWIO, SCMP_SYS(pciconfig_iobase) },
|
||||
{ CAP_SYS_RAWIO, SCMP_SYS(pciconfig_read) },
|
||||
{ CAP_SYS_RAWIO, SCMP_SYS(pciconfig_write) },
|
||||
{ 0, "kexec_load" },
|
||||
{ 0, "keyctl" }, /* keyring is not namespaced */
|
||||
{ 0, "lock" }, /* obsolete syscall */
|
||||
{ 0, "lookup_dcookie" },
|
||||
{ 0, "mpx" }, /* obsolete syscall */
|
||||
{ 0, "nfsservctl" }, /* obsolete syscall */
|
||||
{ 0, "open_by_handle_at" },
|
||||
{ 0, "perf_event_open" },
|
||||
{ 0, "prof" }, /* obsolete syscall */
|
||||
{ 0, "profil" }, /* obsolete syscall */
|
||||
{ 0, "putpmsg" }, /* obsolete syscall */
|
||||
{ 0, "query_module" }, /* obsolete syscall */
|
||||
{ 0, "quotactl" },
|
||||
{ 0, "request_key" }, /* keyring is not namespaced */
|
||||
{ 0, "security" }, /* obsolete syscall */
|
||||
{ 0, "sgetmask" }, /* obsolete syscall */
|
||||
{ 0, "ssetmask" }, /* obsolete syscall */
|
||||
{ 0, "stty" }, /* obsolete syscall */
|
||||
{ 0, "swapoff" },
|
||||
{ 0, "swapon" },
|
||||
{ 0, "sysfs" }, /* obsolete syscall */
|
||||
{ 0, "tuxcall" }, /* obsolete syscall */
|
||||
{ 0, "ulimit" }, /* obsolete syscall */
|
||||
{ 0, "uselib" }, /* obsolete syscall */
|
||||
{ 0, "ustat" }, /* obsolete syscall */
|
||||
{ 0, "vserver" }, /* obsolete syscall */
|
||||
{ CAP_SYSLOG, "syslog" },
|
||||
{ CAP_SYS_MODULE, "delete_module" },
|
||||
{ CAP_SYS_MODULE, "finit_module" },
|
||||
{ CAP_SYS_MODULE, "init_module" },
|
||||
{ CAP_SYS_PACCT, "acct" },
|
||||
{ CAP_SYS_PTRACE, "process_vm_readv" },
|
||||
{ CAP_SYS_PTRACE, "process_vm_writev" },
|
||||
{ CAP_SYS_PTRACE, "ptrace" },
|
||||
{ CAP_SYS_RAWIO, "ioperm" },
|
||||
{ CAP_SYS_RAWIO, "iopl" },
|
||||
{ CAP_SYS_RAWIO, "pciconfig_iobase" },
|
||||
{ CAP_SYS_RAWIO, "pciconfig_read" },
|
||||
{ CAP_SYS_RAWIO, "pciconfig_write" },
|
||||
#ifdef __NR_s390_pci_mmio_read
|
||||
{ CAP_SYS_RAWIO, SCMP_SYS(s390_pci_mmio_read) },
|
||||
{ CAP_SYS_RAWIO, "s390_pci_mmio_read" },
|
||||
#endif
|
||||
#ifdef __NR_s390_pci_mmio_write
|
||||
{ CAP_SYS_RAWIO, SCMP_SYS(s390_pci_mmio_write) },
|
||||
{ CAP_SYS_RAWIO, "s390_pci_mmio_write" },
|
||||
#endif
|
||||
{ CAP_SYS_TIME, SCMP_SYS(adjtimex) },
|
||||
{ CAP_SYS_TIME, SCMP_SYS(clock_adjtime) },
|
||||
{ CAP_SYS_TIME, SCMP_SYS(clock_settime) },
|
||||
{ CAP_SYS_TIME, SCMP_SYS(settimeofday) },
|
||||
{ CAP_SYS_TIME, SCMP_SYS(stime) },
|
||||
{ CAP_SYS_TIME, "adjtimex" },
|
||||
{ CAP_SYS_TIME, "clock_adjtime" },
|
||||
{ CAP_SYS_TIME, "clock_settime" },
|
||||
{ CAP_SYS_TIME, "settimeofday" },
|
||||
{ CAP_SYS_TIME, "stime" },
|
||||
};
|
||||
unsigned i;
|
||||
|
||||
int r, c = 0;
|
||||
size_t i;
|
||||
|
||||
for (i = 0; i < ELEMENTSOF(blacklist); i++) {
|
||||
if (blacklist[i].capability != 0 && (cap_list_retain & (1ULL << blacklist[i].capability)))
|
||||
continue;
|
||||
|
||||
r = seccomp_rule_add_exact(ctx, SCMP_ACT_ERRNO(EPERM), blacklist[i].syscall_num, 0);
|
||||
if (r < 0) {
|
||||
r = seccomp_add_syscall_filter_item(ctx, blacklist[i].name, SCMP_ACT_ERRNO(EPERM));
|
||||
if (r < 0)
|
||||
/* If the system call is not known on this architecture, then that's fine, let's ignore it */
|
||||
_cleanup_free_ char *n = NULL;
|
||||
|
||||
n = seccomp_syscall_resolve_num_arch(arch, blacklist[i].syscall_num);
|
||||
log_debug_errno(r, "Failed to add rule for system call %s, ignoring: %m", strna(n));
|
||||
} else
|
||||
log_debug_errno(r, "Failed to add rule for system call %s, ignoring: %m", blacklist[i].name);
|
||||
else
|
||||
c++;
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue