system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-07-21 10:17:21 +00:00
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Merge pull request #23126 from keszybz/clone3-prohibit

Browse source 
Prohibit clone3() when RestrictNamespaces is used
This commit is contained in:
Luca Boccassi 2022-04-20 11:27:58 +02:00 committed by GitHub
parent da13d2ca07 30193fe817
commit 7d40544643
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
src/shared/seccomp-util.c
View file

@ -718,6 +718,9 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
.value =
"capget\0" /* Able to query arbitrary processes */
"clone\0"
/* ia64 as the only architecture has clone2, a replacement for clone, but ia64 doesn't
* implement seccomp, so we don't need to list it at all. C.f.
* acce2f71779c54086962fefce3833d886c655f62 in the kernel. */
"clone3\0"
"execveat\0"
"fork\0"
@ -1227,6 +1230,21 @@ int seccomp_restrict_namespaces(unsigned long retain) {
if (r < 0)
return r;
/* We cannot filter on individual flags to clone3(), and we need to disable the
* syscall altogether. ENOSYS is used instead of EPERM, so that glibc and other
* users shall fall back to clone(), as if on an older kernel.
*
* C.f. https://github.com/flatpak/flatpak/commit/a10f52a7565c549612c92b8e736a6698a53db330,
* https://github.com/moby/moby/issues/42680. */
r = seccomp_rule_add_exact(
seccomp,
SCMP_ACT_ERRNO(ENOSYS),
SCMP_SYS(clone3),
0);
if (r < 0)
log_debug_errno(r, "Failed to add clone3() rule for architecture %s, ignoring: %m", seccomp_arch_to_string(arch));
if ((retain & NAMESPACE_FLAGS_ALL) == 0)
/* If every single kind of namespace shall be prohibited, then let's block the whole setns() syscall
* altogether. */