X Tutup
Skip to content

Commit ee8d493

Browse files
poetteringpoettering
authored
Merge pull request systemd#10158 from keszybz/seccomp-log-tightening
Seccomp log tightening
2 parents 0eeba7a + 7e86bd7 commit ee8d493

File tree

5 files changed

+122
-88
lines changed

5 files changed

+122
-88
lines changed

‎src/core/execute.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1432,7 +1432,7 @@ static int apply_syscall_filter(const Unit* u, const ExecContext *c, bool needs_
14321432
return r;
14331433
}
14341434

1435-
return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action);
1435+
return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action, false);
14361436
}
14371437

14381438
static int apply_syscall_archs(const Unit *u, const ExecContext *c) {
@@ -1515,7 +1515,7 @@ static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) {
15151515
if (skip_seccomp_unavailable(u, "ProtectKernelModules="))
15161516
return 0;
15171517

1518-
return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM));
1518+
return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM), false);
15191519
}
15201520

15211521
static int apply_private_devices(const Unit *u, const ExecContext *c) {
@@ -1530,7 +1530,7 @@ static int apply_private_devices(const Unit *u, const ExecContext *c) {
15301530
if (skip_seccomp_unavailable(u, "PrivateDevices="))
15311531
return 0;
15321532

1533-
return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM));
1533+
return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM), false);
15341534
}
15351535

15361536
static int apply_restrict_namespaces(const Unit *u, const ExecContext *c) {

‎src/nspawn/nspawn-seccomp.c‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -140,31 +140,27 @@ static int seccomp_add_default_syscall_filter(
140140
*/
141141
};
142142

143-
int r, c = 0;
143+
int r;
144144
size_t i;
145145
char **p;
146146

147147
for (i = 0; i < ELEMENTSOF(whitelist); i++) {
148148
if (whitelist[i].capability != 0 && (cap_list_retain & (1ULL << whitelist[i].capability)) == 0)
149149
continue;
150150

151-
r = seccomp_add_syscall_filter_item(ctx, whitelist[i].name, SCMP_ACT_ALLOW, syscall_blacklist);
151+
r = seccomp_add_syscall_filter_item(ctx, whitelist[i].name, SCMP_ACT_ALLOW, syscall_blacklist, false);
152152
if (r < 0)
153-
/* If the system call is not known on this architecture, then that's fine, let's ignore it */
154-
log_debug_errno(r, "Failed to add rule for system call %s on %s, ignoring: %m", whitelist[i].name, seccomp_arch_to_string(arch));
155-
else
156-
c++;
153+
return log_error_errno(r, "Failed to add syscall filter item %s: %m", whitelist[i].name);
157154
}
158155

159156
STRV_FOREACH(p, syscall_whitelist) {
160-
r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_blacklist);
157+
r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_blacklist, false);
161158
if (r < 0)
162-
log_debug_errno(r, "Failed to add rule for system call %s on %s, ignoring: %m", *p, seccomp_arch_to_string(arch));
163-
else
164-
c++;
159+
log_warning_errno(r, "Failed to add rule for system call %s on %s, ignoring: %m",
160+
*p, seccomp_arch_to_string(arch));
165161
}
166162

167-
return c;
163+
return 0;
168164
}
169165

170166
int setup_seccomp(uint64_t cap_list_retain, char **syscall_whitelist, char **syscall_blacklist) {

‎src/shared/seccomp-util.c‎

Lines changed: 42 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -858,11 +858,9 @@ const SyscallFilterSet *syscall_filter_set_find(const char *name) {
858858
return NULL;
859859
}
860860

861-
static int seccomp_add_syscall_filter_set(scmp_filter_ctx seccomp, const SyscallFilterSet *set, uint32_t action, char **exclude);
862-
863-
int seccomp_add_syscall_filter_item(scmp_filter_ctx *seccomp, const char *name, uint32_t action, char **exclude) {
864-
int r;
861+
static int seccomp_add_syscall_filter_set(scmp_filter_ctx seccomp, const SyscallFilterSet *set, uint32_t action, char **exclude, bool log_missing);
865862

863+
int seccomp_add_syscall_filter_item(scmp_filter_ctx *seccomp, const char *name, uint32_t action, char **exclude, bool log_missing) {
866864
assert(seccomp);
867865
assert(name);
868866

@@ -878,32 +876,40 @@ int seccomp_add_syscall_filter_item(scmp_filter_ctx *seccomp, const char *name,
878876
return -EINVAL;
879877
}
880878

881-
r = seccomp_add_syscall_filter_set(seccomp, other, action, exclude);
882-
if (r < 0)
883-
return r;
879+
return seccomp_add_syscall_filter_set(seccomp, other, action, exclude, log_missing);
880+
884881
} else {
885-
int id;
882+
int id, r;
886883

887884
id = seccomp_syscall_resolve_name(name);
888885
if (id == __NR_SCMP_ERROR) {
889-
log_debug("System call %s is not known, ignoring.", name);
886+
if (log_missing)
887+
log_debug("System call %s is not known, ignoring.", name);
890888
return 0;
891889
}
892890

893891
r = seccomp_rule_add_exact(seccomp, action, id, 0);
894-
if (r < 0)
892+
if (r < 0) {
895893
/* If the system call is not known on this architecture, then that's fine, let's ignore it */
896-
log_debug_errno(r, "Failed to add rule for system call %s() / %d, ignoring: %m", name, id);
897-
}
894+
bool ignore = r == -EDOM;
898895

899-
return 0;
896+
if (!ignore || log_missing)
897+
log_debug_errno(r, "Failed to add rule for system call %s() / %d%s: %m",
898+
name, id, ignore ? ", ignoring" : "");
899+
if (!ignore)
900+
return r;
901+
}
902+
903+
return 0;
904+
}
900905
}
901906

902907
static int seccomp_add_syscall_filter_set(
903908
scmp_filter_ctx seccomp,
904909
const SyscallFilterSet *set,
905910
uint32_t action,
906-
char **exclude) {
911+
char **exclude,
912+
bool log_missing) {
907913

908914
const char *sys;
909915
int r;
@@ -912,15 +918,15 @@ static int seccomp_add_syscall_filter_set(
912918
assert(set);
913919

914920
NULSTR_FOREACH(sys, set->value) {
915-
r = seccomp_add_syscall_filter_item(seccomp, sys, action, exclude);
921+
r = seccomp_add_syscall_filter_item(seccomp, sys, action, exclude, log_missing);
916922
if (r < 0)
917923
return r;
918924
}
919925

920926
return 0;
921927
}
922928

923-
int seccomp_load_syscall_filter_set(uint32_t default_action, const SyscallFilterSet *set, uint32_t action) {
929+
int seccomp_load_syscall_filter_set(uint32_t default_action, const SyscallFilterSet *set, uint32_t action, bool log_missing) {
924930
uint32_t arch;
925931
int r;
926932

@@ -938,11 +944,9 @@ int seccomp_load_syscall_filter_set(uint32_t default_action, const SyscallFilter
938944
if (r < 0)
939945
return r;
940946

941-
r = seccomp_add_syscall_filter_set(seccomp, set, action, NULL);
942-
if (r < 0) {
943-
log_debug_errno(r, "Failed to add filter set, ignoring: %m");
944-
continue;
945-
}
947+
r = seccomp_add_syscall_filter_set(seccomp, set, action, NULL, log_missing);
948+
if (r < 0)
949+
return log_debug_errno(r, "Failed to add filter set: %m");
946950

947951
r = seccomp_load(seccomp);
948952
if (IN_SET(r, -EPERM, -EACCES))
@@ -954,7 +958,7 @@ int seccomp_load_syscall_filter_set(uint32_t default_action, const SyscallFilter
954958
return 0;
955959
}
956960

957-
int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* set, uint32_t action) {
961+
int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* set, uint32_t action, bool log_missing) {
958962
uint32_t arch;
959963
int r;
960964

@@ -967,28 +971,35 @@ int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* set, u
967971
SECCOMP_FOREACH_LOCAL_ARCH(arch) {
968972
_cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL;
969973
Iterator i;
970-
void *id, *val;
974+
void *syscall_id, *val;
971975

972976
log_debug("Operating on architecture: %s", seccomp_arch_to_string(arch));
973977

974978
r = seccomp_init_for_arch(&seccomp, arch, default_action);
975979
if (r < 0)
976980
return r;
977981

978-
HASHMAP_FOREACH_KEY(val, id, set, i) {
982+
HASHMAP_FOREACH_KEY(val, syscall_id, set, i) {
979983
uint32_t a = action;
980-
int e = PTR_TO_INT(val);
984+
int id = PTR_TO_INT(syscall_id) - 1;
985+
int error = PTR_TO_INT(val);
981986

982-
if (action != SCMP_ACT_ALLOW && e >= 0)
983-
a = SCMP_ACT_ERRNO(e);
987+
if (action != SCMP_ACT_ALLOW && error >= 0)
988+
a = SCMP_ACT_ERRNO(error);
984989

985-
r = seccomp_rule_add_exact(seccomp, a, PTR_TO_INT(id) - 1, 0);
990+
r = seccomp_rule_add_exact(seccomp, a, id, 0);
986991
if (r < 0) {
987992
/* If the system call is not known on this architecture, then that's fine, let's ignore it */
988993
_cleanup_free_ char *n = NULL;
989-
990-
n = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
991-
log_debug_errno(r, "Failed to add rule for system call %s() / %d, ignoring: %m", strna(n), PTR_TO_INT(id) - 1);
994+
bool ignore;
995+
996+
n = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, id);
997+
ignore = r == -EDOM;
998+
if (!ignore || log_missing)
999+
log_debug_errno(r, "Failed to add rule for system call %s() / %d%s: %m",
1000+
strna(n), id, ignore ? ", ignoring" : "");
1001+
if (!ignore)
1002+
return r;
9921003
}
9931004
}
9941005

‎src/shared/seccomp-util.h‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,10 +58,10 @@ const SyscallFilterSet *syscall_filter_set_find(const char *name);
5858

5959
int seccomp_filter_set_add(Hashmap *s, bool b, const SyscallFilterSet *set);
6060

61-
int seccomp_add_syscall_filter_item(scmp_filter_ctx *ctx, const char *name, uint32_t action, char **exclude);
61+
int seccomp_add_syscall_filter_item(scmp_filter_ctx *ctx, const char *name, uint32_t action, char **exclude, bool log_missing);
6262

63-
int seccomp_load_syscall_filter_set(uint32_t default_action, const SyscallFilterSet *set, uint32_t action);
64-
int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* set, uint32_t action);
63+
int seccomp_load_syscall_filter_set(uint32_t default_action, const SyscallFilterSet *set, uint32_t action, bool log_missing);
64+
int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* set, uint32_t action, bool log_missing);
6565

6666
typedef enum SeccompParseFlags {
6767
SECCOMP_PARSE_INVERT = 1 << 0,

0 commit comments

Comments
 (0)
X Tutup