Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
aboutsummaryrefslogtreecommitdiff
path: root/seccomp-bpf.c
Commit message (Collapse)AuthorAgeFilesLines
* seccomp: make socket() fail with -ENOSYSMathias Krause2024-07-221-5/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | At least Debian's glibc tries to make use of nscd by default leading to the getpwuid() / getpwnam() calls in pspax trying to open up a local connection to /var/run/nscd/socket. Neither socket() nor connect() are allowed by the seccomp policy, leading to unavoidable killing of the process: $ pspax USER PID PAX MAPS ETYPE NAME CAPS ATTR Bad system call (core dumped) $ strace pspax |& tail -3 newfstatat(4, "stat", {st_mode=S_IFREG|0444, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 41 +++ killed by SIGSYS (core dumped) +++ Fix this by making socket() fail with -ENOSYS instead: $ strace -e trace=socket ./build/pspax >/dev/null socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = -1 ENOSYS (Function not implemented) socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = -1 ENOSYS (Function not implemented) +++ exited with 0 +++ Signed-off-by: Mathias Krause <minipli@grsecurity.net> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* update copyright headersMike Frysinger2024-01-011-2/+2
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* Undo IWYU fixesSam James2023-01-291-1/+0
| | | | | | | | | | | | I wasn't paying enough attention, it's better to just fold the needed bits into porting.h. This reverts commit ffedc60fa41d307bda28fd108e6ff1b8da1fc2ee. This reverts commit f8287200aec0ca33ef07fafcdd5aef0aa6eb1306. This reverts commit aa907a42d89ddfd5a7e64d8182a1da35277f2f6e. Bug: https://github.com/gentoo/pax-utils/pull/11#issuecomment-1407566344 Signed-off-by: Sam James <sam@gentoo.org>
* *: IWYU fixes deuxSam James2023-01-291-0/+1
| | | | Signed-off-by: Sam James <sam@gentoo.org>
* seccomp: allow madvise() call (glibc 2.35+)v1.3.4WANG Xuerui2022-04-251-0/+3
| | | | | | Closes: https://bugs.gentoo.org/836735 Reviewed-by: Sam James <sam@gentoo.org> Signed-off-by: WANG Xuerui <xen0n@gentoo.org>
* seccomp: mark arrays const+staticMike Frysinger2021-10-161-3/+3
| | | | | | | This generates better code, although it doesn't super matter since this is only used at build time. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* seccomp: allow getrandom() call (glibc-2.34+)v1.3.3Sergei Trofimovich2021-07-221-0/+3
| | | | | Reported-by: Andreas K. Hüttel Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
* seccomp-bpf: fix warnings by not using nexted open commentsv1.3.2Sergei Trofimovich2021-06-101-2/+3
| | | | Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
* seccomp: fix build failure on mips (use _MIP_SIM tests)Sergei Trofimovich2021-06-101-7/+9
| | | | | | | | | | | | | | | | | | | | glibc's sysdeps/mips/sgidefs.h unconditionally mips _ABI* enum values: #define _ABIO32 1 #define _ABIN32 2 #define _ABI64 3 #define _ABIO64 4 This causes build failures on multiple definitions: In file included from security.c:9: seccomp-bpf.h:73:28: error: redefinition of 'seccomp_bpf_blks_base' 73 | static const unsigned char seccomp_bpf_blks_base[] = { | ^~~~~~~~~~~~~~~~~~~~~ The fix is to test current ABI against _MIPS_SIM. Fixed-by: Manuel Lauss Bug: https://bugs.gentoo.org/795075 Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
* security: restore syscalls accidentally droppedv1.3.1Mike Frysinger2021-04-181-0/+13
| | | | | | | | | The original precompile work was done against an old version of pax-utils and I forgot to resync the list before finalizing. Restore all the syscalls that were in here before. Bug: https://bugs.gentoo.org/783459 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* security: pregen seccomp bpf programsv1.3Mike Frysinger2021-04-171-0/+255
Since the bpf programs are the same across runs, generate it ahead of time. This way we don't have to link against libseccomp and run the library calls at runtime which helps cut out most overhead. Signed-off-by: Mike Frysinger <vapier@gentoo.org>