1 files changed, 74 insertions, 18 deletions

diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 609e0619af..44706669b4 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -1086,27 +1086,81 @@ int seccomp_restrict_realtime(void) {
 }
 
 int seccomp_memory_deny_write_execute(void) {
+
         uint32_t arch;
         int r;
 
         SECCOMP_FOREACH_LOCAL_ARCH(arch) {
                 _cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL;
+                int filter_syscall = 0, block_syscall = 0, shmat_syscall = 0;
 
                 log_debug("Operating on architecture: %s", seccomp_arch_to_string(arch));
 
+                switch (arch) {
+
+                case SCMP_ARCH_X86:
+                        filter_syscall = SCMP_SYS(mmap2);
+                        block_syscall = SCMP_SYS(mmap);
+
+                        /* Note that shmat() isn't available on i386, where the call is multiplexed through ipc(). We
+                         * ignore that here, which means there's still a way to get writable/executable memory, if an
+                         * IPC key is mapped like this on i386. That's a pity, but no total loss. */
+                        break;
+
+                case SCMP_ARCH_X86_64:
+                case SCMP_ARCH_X32:
+                        filter_syscall = SCMP_SYS(mmap);
+                        shmat_syscall = SCMP_SYS(shmat);
+                        break;
+
+                /* Please add more definitions here, if you port systemd to other architectures! */
+
+#if !defined(__i386__) && !defined(__x86_64__)
+#warning "Consider adding the right mmap() syscall definitions here!"
+#endif
+                }
+
+                /* Can't filter mmap() on this arch, then skip it */
+                if (filter_syscall == 0)
+                        continue;
+
                 r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ALLOW);
                 if (r < 0)
                         return r;
 
-                r = seccomp_rule_add_exact(
-                                seccomp,
-                                SCMP_ACT_ERRNO(EPERM),
-                                SCMP_SYS(mmap),
-                                1,
-                                SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC|PROT_WRITE, PROT_EXEC|PROT_WRITE));
-                if (r < 0) {
-                        log_debug_errno(r, "Failed to add mmap() rule for architecture %s, skipping: %m", seccomp_arch_to_string(arch));
-                        continue;
+                if (filter_syscall != 0)  {
+                        r = seccomp_rule_add_exact(
+                                        seccomp,
+                                        SCMP_ACT_ERRNO(EPERM),
+                                        filter_syscall,
+                                        1,
+                                        SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC|PROT_WRITE, PROT_EXEC|PROT_WRITE));
+                        if (r < 0) {
+                                _cleanup_free_ char *n = NULL;
+
+                                n = seccomp_syscall_resolve_num_arch(arch, filter_syscall);
+                                log_debug_errno(r, "Failed to add %s() rule for architecture %s, skipping: %m",
+                                                strna(n),
+                                                seccomp_arch_to_string(arch));
+                                continue;
+                        }
+                }
+
+                if (block_syscall != 0) {
+                        r = seccomp_rule_add_exact(
+                                        seccomp,
+                                        SCMP_ACT_ERRNO(EPERM),
+                                        block_syscall,
+                                        0);
+                        if (r < 0) {
+                                _cleanup_free_ char *n = NULL;
+
+                                n = seccomp_syscall_resolve_num_arch(arch, block_syscall);
+                                log_debug_errno(r, "Failed to add %s() rule for architecture %s, skipping: %m",
+                                                strna(n),
+                                                seccomp_arch_to_string(arch));
+                                continue;
+                        }
                 }
 
                 r = seccomp_rule_add_exact(
@@ -1120,15 +1174,17 @@ int seccomp_memory_deny_write_execute(void) {
                         continue;
                 }
 
-                r = seccomp_rule_add_exact(
-                                seccomp,
-                                SCMP_ACT_ERRNO(EPERM),
-                                SCMP_SYS(shmat),
-                                1,
-                                SCMP_A2(SCMP_CMP_MASKED_EQ, SHM_EXEC, SHM_EXEC));
-                if (r < 0) {
-                        log_debug_errno(r, "Failed to add shmat() rule for architecture %s, skipping: %m", seccomp_arch_to_string(arch));
-                        continue;
+                if (shmat_syscall != 0) {
+                        r = seccomp_rule_add_exact(
+                                        seccomp,
+                                        SCMP_ACT_ERRNO(EPERM),
+                                        SCMP_SYS(shmat),
+                                        1,
+                                        SCMP_A2(SCMP_CMP_MASKED_EQ, SHM_EXEC, SHM_EXEC));
+                        if (r < 0) {
+                                log_debug_errno(r, "Failed to add shmat() rule for architecture %s, skipping: %m", seccomp_arch_to_string(arch));
+                                continue;
+                        }
                 }
 
                 r = seccomp_load(seccomp);