summaryrefslogtreecommitdiff
path: root/src/shared
diff options
context:
space:
mode:
Diffstat (limited to 'src/shared')
-rw-r--r--src/shared/condition.c9
-rw-r--r--src/shared/install-printf.c57
-rw-r--r--src/shared/install.c99
-rw-r--r--src/shared/install.h34
-rw-r--r--src/shared/seccomp-util.c185
-rw-r--r--src/shared/seccomp-util.h37
6 files changed, 298 insertions, 123 deletions
diff --git a/src/shared/condition.c b/src/shared/condition.c
index 17b80d9e0c..8bd6a51a99 100644
--- a/src/shared/condition.c
+++ b/src/shared/condition.c
@@ -328,9 +328,9 @@ static int condition_test_needs_update(Condition *c) {
uint64_t timestamp;
int r;
- r = parse_env_file(p, NULL, "TimestampNSec", &timestamp_str, NULL);
+ r = parse_env_file(p, NULL, "TIMESTAMP_NSEC", &timestamp_str, NULL);
if (r < 0) {
- log_error_errno(-r, "Failed to parse timestamp file '%s', using mtime: %m", p);
+ log_error_errno(r, "Failed to parse timestamp file '%s', using mtime: %m", p);
return true;
} else if (r == 0) {
log_debug("No data in timestamp file '%s', using mtime", p);
@@ -339,12 +339,11 @@ static int condition_test_needs_update(Condition *c) {
r = safe_atou64(timestamp_str, &timestamp);
if (r < 0) {
- log_error_errno(-r, "Failed to parse timestamp value '%s' in file '%s', using mtime: %m",
- timestamp_str, p);
+ log_error_errno(r, "Failed to parse timestamp value '%s' in file '%s', using mtime: %m", timestamp_str, p);
return true;
}
- other.st_mtim.tv_nsec = timestamp % NSEC_PER_SEC;
+ timespec_store(&other.st_mtim, timestamp);
}
return usr.st_mtim.tv_nsec > other.st_mtim.tv_nsec;
diff --git a/src/shared/install-printf.c b/src/shared/install-printf.c
index 88143361da..cbdf66827f 100644
--- a/src/shared/install-printf.c
+++ b/src/shared/install-printf.c
@@ -27,19 +27,54 @@
#include "install.h"
#include "macro.h"
#include "specifier.h"
+#include "string-util.h"
#include "unit-name.h"
#include "user-util.h"
static int specifier_prefix_and_instance(char specifier, void *data, void *userdata, char **ret) {
- UnitFileInstallInfo *i = userdata;
+ const UnitFileInstallInfo *i = userdata;
+ _cleanup_free_ char *prefix = NULL;
+ int r;
assert(i);
- return unit_name_to_prefix_and_instance(i->name, ret);
+ r = unit_name_to_prefix_and_instance(i->name, &prefix);
+ if (r < 0)
+ return r;
+
+ if (endswith(prefix, "@") && i->default_instance) {
+ char *ans;
+
+ ans = strjoin(prefix, i->default_instance, NULL);
+ if (!ans)
+ return -ENOMEM;
+ *ret = ans;
+ } else {
+ *ret = prefix;
+ prefix = NULL;
+ }
+
+ return 0;
+}
+
+static int specifier_name(char specifier, void *data, void *userdata, char **ret) {
+ const UnitFileInstallInfo *i = userdata;
+ char *ans;
+
+ assert(i);
+
+ if (unit_name_is_valid(i->name, UNIT_NAME_TEMPLATE) && i->default_instance)
+ return unit_name_replace_instance(i->name, i->default_instance, ret);
+
+ ans = strdup(i->name);
+ if (!ans)
+ return -ENOMEM;
+ *ret = ans;
+ return 0;
}
static int specifier_prefix(char specifier, void *data, void *userdata, char **ret) {
- UnitFileInstallInfo *i = userdata;
+ const UnitFileInstallInfo *i = userdata;
assert(i);
@@ -47,7 +82,7 @@ static int specifier_prefix(char specifier, void *data, void *userdata, char **r
}
static int specifier_instance(char specifier, void *data, void *userdata, char **ret) {
- UnitFileInstallInfo *i = userdata;
+ const UnitFileInstallInfo *i = userdata;
char *instance;
int r;
@@ -57,8 +92,8 @@ static int specifier_instance(char specifier, void *data, void *userdata, char *
if (r < 0)
return r;
- if (!instance) {
- instance = strdup("");
+ if (isempty(instance)) {
+ instance = strdup(i->default_instance ?: "");
if (!instance)
return -ENOMEM;
}
@@ -73,9 +108,13 @@ static int specifier_user_name(char specifier, void *data, void *userdata, char
/* If we are UID 0 (root), this will not result in NSS,
* otherwise it might. This is good, as we want to be able to
* run this in PID 1, where our user ID is 0, but where NSS
- * lookups are not allowed. */
+ * lookups are not allowed.
+
+ * We don't user getusername_malloc() here, because we don't want to look
+ * at $USER, to remain consistent with specifer_user_id() below.
+ */
- t = getusername_malloc();
+ t = uid_to_name(getuid());
if (!t)
return -ENOMEM;
@@ -110,7 +149,7 @@ int install_full_printf(UnitFileInstallInfo *i, const char *format, char **ret)
*/
const Specifier table[] = {
- { 'n', specifier_string, i->name },
+ { 'n', specifier_name, NULL },
{ 'N', specifier_prefix_and_instance, NULL },
{ 'p', specifier_prefix, NULL },
{ 'i', specifier_instance, NULL },
diff --git a/src/shared/install.c b/src/shared/install.c
index d33a658d0a..96fba6e25b 100644
--- a/src/shared/install.c
+++ b/src/shared/install.c
@@ -518,6 +518,7 @@ static int remove_marked_symlinks_fd(
const char *path,
const char *config_path,
const LookupPaths *lp,
+ bool dry_run,
bool *restart,
UnitFileChange **changes,
unsigned *n_changes) {
@@ -566,7 +567,7 @@ static int remove_marked_symlinks_fd(
}
/* This will close nfd, regardless whether it succeeds or not */
- q = remove_marked_symlinks_fd(remove_symlinks_to, nfd, p, config_path, lp, restart, changes, n_changes);
+ q = remove_marked_symlinks_fd(remove_symlinks_to, nfd, p, config_path, lp, dry_run, restart, changes, n_changes);
if (q < 0 && r == 0)
r = q;
@@ -603,14 +604,16 @@ static int remove_marked_symlinks_fd(
if (!found)
continue;
- if (unlinkat(fd, de->d_name, 0) < 0 && errno != ENOENT) {
- if (r == 0)
- r = -errno;
- unit_file_changes_add(changes, n_changes, -errno, p, NULL);
- continue;
- }
+ if (!dry_run) {
+ if (unlinkat(fd, de->d_name, 0) < 0 && errno != ENOENT) {
+ if (r == 0)
+ r = -errno;
+ unit_file_changes_add(changes, n_changes, -errno, p, NULL);
+ continue;
+ }
- (void) rmdir_parents(p, config_path);
+ (void) rmdir_parents(p, config_path);
+ }
unit_file_changes_add(changes, n_changes, UNIT_FILE_UNLINK, p, NULL);
@@ -621,7 +624,7 @@ static int remove_marked_symlinks_fd(
q = mark_symlink_for_removal(&remove_symlinks_to, rp ?: p);
if (q < 0)
return q;
- if (q > 0)
+ if (q > 0 && !dry_run)
*restart = true;
}
}
@@ -633,6 +636,7 @@ static int remove_marked_symlinks(
Set *remove_symlinks_to,
const char *config_path,
const LookupPaths *lp,
+ bool dry_run,
UnitFileChange **changes,
unsigned *n_changes) {
@@ -659,7 +663,7 @@ static int remove_marked_symlinks(
return -errno;
/* This takes possession of cfd and closes it */
- q = remove_marked_symlinks_fd(remove_symlinks_to, cfd, config_path, config_path, lp, &restart, changes, n_changes);
+ q = remove_marked_symlinks_fd(remove_symlinks_to, cfd, config_path, config_path, lp, dry_run, &restart, changes, n_changes);
if (r == 0)
r = q;
} while (restart);
@@ -1805,10 +1809,9 @@ static int install_context_mark_for_removal(
int unit_file_mask(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
- bool force,
UnitFileChange **changes,
unsigned *n_changes) {
@@ -1824,7 +1827,7 @@ int unit_file_mask(
if (r < 0)
return r;
- config_path = runtime ? paths.runtime_config : paths.persistent_config;
+ config_path = (flags & UNIT_FILE_RUNTIME) ? paths.runtime_config : paths.persistent_config;
STRV_FOREACH(i, files) {
_cleanup_free_ char *path = NULL;
@@ -1840,7 +1843,7 @@ int unit_file_mask(
if (!path)
return -ENOMEM;
- q = create_symlink(&paths, "/dev/null", path, force, changes, n_changes);
+ q = create_symlink(&paths, "/dev/null", path, !!(flags & UNIT_FILE_FORCE), changes, n_changes);
if (q < 0 && r >= 0)
r = q;
}
@@ -1850,7 +1853,7 @@ int unit_file_mask(
int unit_file_unmask(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
UnitFileChange **changes,
@@ -1862,6 +1865,7 @@ int unit_file_unmask(
size_t n_todo = 0, n_allocated = 0;
const char *config_path;
char **i;
+ bool dry_run;
int r, q;
assert(scope >= 0);
@@ -1871,7 +1875,8 @@ int unit_file_unmask(
if (r < 0)
return r;
- config_path = runtime ? paths.runtime_config : paths.persistent_config;
+ config_path = (flags & UNIT_FILE_RUNTIME) ? paths.runtime_config : paths.persistent_config;
+ dry_run = !!(flags & UNIT_FILE_DRY_RUN);
STRV_FOREACH(i, files) {
_cleanup_free_ char *path = NULL;
@@ -1908,7 +1913,7 @@ int unit_file_unmask(
if (!path)
return -ENOMEM;
- if (unlink(path) < 0) {
+ if (!dry_run && unlink(path) < 0) {
if (errno != ENOENT) {
if (r >= 0)
r = -errno;
@@ -1926,7 +1931,7 @@ int unit_file_unmask(
return q;
}
- q = remove_marked_symlinks(remove_symlinks_to, config_path, &paths, changes, n_changes);
+ q = remove_marked_symlinks(remove_symlinks_to, config_path, &paths, dry_run, changes, n_changes);
if (r >= 0)
r = q;
@@ -1935,10 +1940,9 @@ int unit_file_unmask(
int unit_file_link(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
- bool force,
UnitFileChange **changes,
unsigned *n_changes) {
@@ -1956,7 +1960,7 @@ int unit_file_link(
if (r < 0)
return r;
- config_path = runtime ? paths.runtime_config : paths.persistent_config;
+ config_path = (flags & UNIT_FILE_RUNTIME) ? paths.runtime_config : paths.persistent_config;
STRV_FOREACH(i, files) {
_cleanup_free_ char *full = NULL;
@@ -2005,7 +2009,7 @@ int unit_file_link(
if (!new_path)
return -ENOMEM;
- q = create_symlink(&paths, *i, new_path, force, changes, n_changes);
+ q = create_symlink(&paths, *i, new_path, !!(flags & UNIT_FILE_FORCE), changes, n_changes);
if (q < 0 && r >= 0)
r = q;
}
@@ -2177,11 +2181,11 @@ int unit_file_revert(
return q;
}
- q = remove_marked_symlinks(remove_symlinks_to, paths.runtime_config, &paths, changes, n_changes);
+ q = remove_marked_symlinks(remove_symlinks_to, paths.runtime_config, &paths, false, changes, n_changes);
if (r >= 0)
r = q;
- q = remove_marked_symlinks(remove_symlinks_to, paths.persistent_config, &paths, changes, n_changes);
+ q = remove_marked_symlinks(remove_symlinks_to, paths.persistent_config, &paths, false, changes, n_changes);
if (r >= 0)
r = q;
@@ -2190,12 +2194,11 @@ int unit_file_revert(
int unit_file_add_dependency(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
const char *target,
UnitDependency dep,
- bool force,
UnitFileChange **changes,
unsigned *n_changes) {
@@ -2220,7 +2223,7 @@ int unit_file_add_dependency(
if (r < 0)
return r;
- config_path = runtime ? paths.runtime_config : paths.persistent_config;
+ config_path = (flags & UNIT_FILE_RUNTIME) ? paths.runtime_config : paths.persistent_config;
r = install_info_discover(scope, &c, &paths, target, SEARCH_FOLLOW_CONFIG_SYMLINKS,
&target_info, changes, n_changes);
@@ -2260,15 +2263,14 @@ int unit_file_add_dependency(
return -ENOMEM;
}
- return install_context_apply(scope, &c, &paths, config_path, force, SEARCH_FOLLOW_CONFIG_SYMLINKS, changes, n_changes);
+ return install_context_apply(scope, &c, &paths, config_path, !!(flags & UNIT_FILE_FORCE), SEARCH_FOLLOW_CONFIG_SYMLINKS, changes, n_changes);
}
int unit_file_enable(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
- bool force,
UnitFileChange **changes,
unsigned *n_changes) {
@@ -2286,7 +2288,7 @@ int unit_file_enable(
if (r < 0)
return r;
- config_path = runtime ? paths.runtime_config : paths.persistent_config;
+ config_path = (flags & UNIT_FILE_RUNTIME) ? paths.runtime_config : paths.persistent_config;
STRV_FOREACH(f, files) {
r = install_info_discover(scope, &c, &paths, *f, SEARCH_LOAD|SEARCH_FOLLOW_CONFIG_SYMLINKS,
@@ -2305,12 +2307,12 @@ int unit_file_enable(
is useful to determine whether the passed files had any
installation data at all. */
- return install_context_apply(scope, &c, &paths, config_path, force, SEARCH_LOAD, changes, n_changes);
+ return install_context_apply(scope, &c, &paths, config_path, !!(flags & UNIT_FILE_FORCE), SEARCH_LOAD, changes, n_changes);
}
int unit_file_disable(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
UnitFileChange **changes,
@@ -2330,7 +2332,7 @@ int unit_file_disable(
if (r < 0)
return r;
- config_path = runtime ? paths.runtime_config : paths.persistent_config;
+ config_path = (flags & UNIT_FILE_RUNTIME) ? paths.runtime_config : paths.persistent_config;
STRV_FOREACH(i, files) {
if (!unit_name_is_valid(*i, UNIT_NAME_ANY))
@@ -2345,15 +2347,14 @@ int unit_file_disable(
if (r < 0)
return r;
- return remove_marked_symlinks(remove_symlinks_to, config_path, &paths, changes, n_changes);
+ return remove_marked_symlinks(remove_symlinks_to, config_path, &paths, !!(flags & UNIT_FILE_DRY_RUN), changes, n_changes);
}
int unit_file_reenable(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
- bool force,
UnitFileChange **changes,
unsigned *n_changes) {
@@ -2368,19 +2369,19 @@ int unit_file_reenable(
n[i] = basename(files[i]);
n[i] = NULL;
- r = unit_file_disable(scope, runtime, root_dir, n, changes, n_changes);
+ r = unit_file_disable(scope, flags, root_dir, n, changes, n_changes);
if (r < 0)
return r;
/* But the enable command with the full name */
- return unit_file_enable(scope, runtime, root_dir, files, force, changes, n_changes);
+ return unit_file_enable(scope, flags, root_dir, files, changes, n_changes);
}
int unit_file_set_default(
UnitFileScope scope,
+ UnitFileFlags flags,
const char *root_dir,
const char *name,
- bool force,
UnitFileChange **changes,
unsigned *n_changes) {
@@ -2411,7 +2412,7 @@ int unit_file_set_default(
return r;
new_path = strjoina(paths.persistent_config, "/" SPECIAL_DEFAULT_TARGET);
- return create_symlink(&paths, i->path, new_path, force, changes, n_changes);
+ return create_symlink(&paths, i->path, new_path, !!(flags & UNIT_FILE_FORCE), changes, n_changes);
}
int unit_file_get_default(
@@ -2735,7 +2736,7 @@ static int execute_preset(
if (r < 0)
return r;
- r = remove_marked_symlinks(remove_symlinks_to, config_path, paths, changes, n_changes);
+ r = remove_marked_symlinks(remove_symlinks_to, config_path, paths, false, changes, n_changes);
} else
r = 0;
@@ -2803,11 +2804,10 @@ static int preset_prepare_one(
int unit_file_preset(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
UnitFilePresetMode mode,
- bool force,
UnitFileChange **changes,
unsigned *n_changes) {
@@ -2826,7 +2826,7 @@ int unit_file_preset(
if (r < 0)
return r;
- config_path = runtime ? paths.runtime_config : paths.persistent_config;
+ config_path = (flags & UNIT_FILE_RUNTIME) ? paths.runtime_config : paths.persistent_config;
r = read_presets(scope, root_dir, &presets);
if (r < 0)
@@ -2838,15 +2838,14 @@ int unit_file_preset(
return r;
}
- return execute_preset(scope, &plus, &minus, &paths, config_path, files, mode, force, changes, n_changes);
+ return execute_preset(scope, &plus, &minus, &paths, config_path, files, mode, !!(flags & UNIT_FILE_FORCE), changes, n_changes);
}
int unit_file_preset_all(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
UnitFilePresetMode mode,
- bool force,
UnitFileChange **changes,
unsigned *n_changes) {
@@ -2865,7 +2864,7 @@ int unit_file_preset_all(
if (r < 0)
return r;
- config_path = runtime ? paths.runtime_config : paths.persistent_config;
+ config_path = (flags & UNIT_FILE_RUNTIME) ? paths.runtime_config : paths.persistent_config;
r = read_presets(scope, root_dir, &presets);
if (r < 0)
@@ -2906,7 +2905,7 @@ int unit_file_preset_all(
}
}
- return execute_preset(scope, &plus, &minus, &paths, config_path, NULL, mode, force, changes, n_changes);
+ return execute_preset(scope, &plus, &minus, &paths, config_path, NULL, mode, !!(flags & UNIT_FILE_FORCE), changes, n_changes);
}
static void unit_file_list_free_one(UnitFileList *f) {
diff --git a/src/shared/install.h b/src/shared/install.h
index b1f220693b..7a5859e729 100644
--- a/src/shared/install.h
+++ b/src/shared/install.h
@@ -23,6 +23,7 @@ typedef enum UnitFileScope UnitFileScope;
typedef enum UnitFileState UnitFileState;
typedef enum UnitFilePresetMode UnitFilePresetMode;
typedef enum UnitFileChangeType UnitFileChangeType;
+typedef enum UnitFileFlags UnitFileFlags;
typedef enum UnitFileType UnitFileType;
typedef struct UnitFileChange UnitFileChange;
typedef struct UnitFileList UnitFileList;
@@ -78,6 +79,12 @@ enum UnitFileChangeType {
_UNIT_FILE_CHANGE_INVALID = INT_MIN
};
+enum UnitFileFlags {
+ UNIT_FILE_RUNTIME = 1,
+ UNIT_FILE_FORCE = 1 << 1,
+ UNIT_FILE_DRY_RUN = 1 << 2,
+};
+
/* type can either one of the UnitFileChangeTypes listed above, or a negative error.
* If source is specified, it should be the contents of the path symlink.
* In case of an error, source should be the existing symlink contents or NULL
@@ -144,65 +151,59 @@ bool unit_type_may_template(UnitType type) _const_;
int unit_file_enable(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
- bool force,
UnitFileChange **changes,
unsigned *n_changes);
int unit_file_disable(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
UnitFileChange **changes,
unsigned *n_changes);
int unit_file_reenable(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
- bool force,
UnitFileChange **changes,
unsigned *n_changes);
int unit_file_preset(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
UnitFilePresetMode mode,
- bool force,
UnitFileChange **changes,
unsigned *n_changes);
int unit_file_preset_all(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
UnitFilePresetMode mode,
- bool force,
UnitFileChange **changes,
unsigned *n_changes);
int unit_file_mask(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
- bool force,
UnitFileChange **changes,
unsigned *n_changes);
int unit_file_unmask(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
UnitFileChange **changes,
unsigned *n_changes);
int unit_file_link(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
- bool force,
UnitFileChange **changes,
unsigned *n_changes);
int unit_file_revert(
@@ -213,9 +214,9 @@ int unit_file_revert(
unsigned *n_changes);
int unit_file_set_default(
UnitFileScope scope,
+ UnitFileFlags flags,
const char *root_dir,
const char *file,
- bool force,
UnitFileChange **changes,
unsigned *n_changes);
int unit_file_get_default(
@@ -224,12 +225,11 @@ int unit_file_get_default(
char **name);
int unit_file_add_dependency(
UnitFileScope scope,
- bool runtime,
+ UnitFileFlags flags,
const char *root_dir,
char **files,
const char *target,
UnitDependency dep,
- bool force,
UnitFileChange **changes,
unsigned *n_changes);
diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 8116c7671f..6252cd16a6 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -26,6 +26,7 @@
#include "macro.h"
#include "seccomp-util.h"
#include "string-util.h"
+#include "util.h"
const char* seccomp_arch_to_string(uint32_t c) {
@@ -73,7 +74,34 @@ int seccomp_arch_from_string(const char *n, uint32_t *ret) {
return 0;
}
-int seccomp_add_secondary_archs(scmp_filter_ctx *c) {
+int seccomp_init_conservative(scmp_filter_ctx *ret, uint32_t default_action) {
+ scmp_filter_ctx seccomp;
+ int r;
+
+ /* Much like seccomp_init(), but tries to be a bit more conservative in its defaults: all secondary archs are
+ * added by default, and NNP is turned off. */
+
+ seccomp = seccomp_init(default_action);
+ if (!seccomp)
+ return -ENOMEM;
+
+ r = seccomp_add_secondary_archs(seccomp);
+ if (r < 0)
+ goto finish;
+
+ r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
+ if (r < 0)
+ goto finish;
+
+ *ret = seccomp;
+ return 0;
+
+finish:
+ seccomp_release(seccomp);
+ return r;
+}
+
+int seccomp_add_secondary_archs(scmp_filter_ctx c) {
#if defined(__i386__) || defined(__x86_64__)
int r;
@@ -110,7 +138,6 @@ int seccomp_add_secondary_archs(scmp_filter_ctx *c) {
#endif
return 0;
-
}
static bool is_basic_seccomp_available(void) {
@@ -132,28 +159,30 @@ bool is_seccomp_available(void) {
return cached_enabled;
}
-const SystemCallFilterSet syscall_filter_sets[] = {
- {
+const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
+ [SYSCALL_FILTER_SET_CLOCK] = {
/* Clock */
- .set_name = "@clock",
+ .name = "@clock",
.value =
"adjtimex\0"
"clock_adjtime\0"
"clock_settime\0"
"settimeofday\0"
"stime\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_CPU_EMULATION] = {
/* CPU emulation calls */
- .set_name = "@cpu-emulation",
+ .name = "@cpu-emulation",
.value =
"modify_ldt\0"
"subpage_prot\0"
"switch_endian\0"
"vm86\0"
"vm86old\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_DEBUG] = {
/* Debugging/Performance Monitoring/Tracing */
- .set_name = "@debug",
+ .name = "@debug",
.value =
"lookup_dcookie\0"
"perf_event_open\0"
@@ -161,11 +190,14 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"process_vm_writev\0"
"ptrace\0"
"rtas\0"
+#ifdef __NR_s390_runtime_instr
"s390_runtime_instr\0"
+#endif
"sys_debug_setcontext\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_DEFAULT] = {
/* Default list */
- .set_name = "@default",
+ .name = "@default",
.value =
"execve\0"
"exit\0"
@@ -173,9 +205,10 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"getrlimit\0" /* make sure processes can query stack size and such */
"rt_sigreturn\0"
"sigreturn\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_IO_EVENT] = {
/* Event loop use */
- .set_name = "@io-event",
+ .name = "@io-event",
.value =
"_newselect\0"
"epoll_create1\0"
@@ -191,9 +224,10 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"ppoll\0"
"pselect6\0"
"select\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_IPC] = {
/* Message queues, SYSV IPC or other IPC: unusual */
- .set_name = "@ipc",
+ .name = "@ipc",
.value = "ipc\0"
"mq_getsetattr\0"
"mq_notify\0"
@@ -215,33 +249,36 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"shmctl\0"
"shmdt\0"
"shmget\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_KEYRING] = {
/* Keyring */
- .set_name = "@keyring",
+ .name = "@keyring",
.value =
"add_key\0"
"keyctl\0"
"request_key\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_MODULE] = {
/* Kernel module control */
- .set_name = "@module",
+ .name = "@module",
.value =
"delete_module\0"
"finit_module\0"
"init_module\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_MOUNT] = {
/* Mounting */
- .set_name = "@mount",
+ .name = "@mount",
.value =
"chroot\0"
"mount\0"
- "oldumount\0"
"pivot_root\0"
"umount2\0"
"umount\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_NETWORK_IO] = {
/* Network or Unix socket IO, should not be needed if not network facing */
- .set_name = "@network-io",
+ .name = "@network-io",
.value =
"accept4\0"
"accept\0"
@@ -264,9 +301,10 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"socket\0"
"socketcall\0"
"socketpair\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_OBSOLETE] = {
/* Unusual, obsolete or unimplemented, some unknown even to libseccomp */
- .set_name = "@obsolete",
+ .name = "@obsolete",
.value =
"_sysctl\0"
"afs_syscall\0"
@@ -292,9 +330,10 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"uselib\0"
"ustat\0"
"vserver\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_PRIVILEGED] = {
/* Nice grab-bag of all system calls which need superuser capabilities */
- .set_name = "@privileged",
+ .name = "@privileged",
.value =
"@clock\0"
"@module\0"
@@ -331,11 +370,12 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"setuid\0"
"swapoff\0"
"swapon\0"
- "sysctl\0"
+ "_sysctl\0"
"vhangup\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_PROCESS] = {
/* Process control, execution, namespaces */
- .set_name = "@process",
+ .name = "@process",
.value =
"arch_prctl\0"
"clone\0"
@@ -349,19 +389,90 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"tkill\0"
"unshare\0"
"vfork\0"
- }, {
+ },
+ [SYSCALL_FILTER_SET_RAW_IO] = {
/* Raw I/O ports */
- .set_name = "@raw-io",
+ .name = "@raw-io",
.value =
"ioperm\0"
"iopl\0"
"pciconfig_iobase\0"
"pciconfig_read\0"
"pciconfig_write\0"
+#ifdef __NR_s390_pci_mmio_read
"s390_pci_mmio_read\0"
+#endif
+#ifdef __NR_s390_pci_mmio_write
"s390_pci_mmio_write\0"
- }, {
- .set_name = NULL,
- .value = NULL
- }
+#endif
+ },
};
+
+const SyscallFilterSet *syscall_filter_set_find(const char *name) {
+ unsigned i;
+
+ if (isempty(name) || name[0] != '@')
+ return NULL;
+
+ for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++)
+ if (streq(syscall_filter_sets[i].name, name))
+ return syscall_filter_sets + i;
+
+ return NULL;
+}
+
+int seccomp_add_syscall_filter_set(scmp_filter_ctx seccomp, const SyscallFilterSet *set, uint32_t action) {
+ const char *sys;
+ int r;
+
+ assert(seccomp);
+ assert(set);
+
+ NULSTR_FOREACH(sys, set->value) {
+ int id;
+
+ if (sys[0] == '@') {
+ const SyscallFilterSet *other;
+
+ other = syscall_filter_set_find(sys);
+ if (!other)
+ return -EINVAL;
+
+ r = seccomp_add_syscall_filter_set(seccomp, other, action);
+ } else {
+ id = seccomp_syscall_resolve_name(sys);
+ if (id == __NR_SCMP_ERROR)
+ return -EINVAL;
+
+ r = seccomp_rule_add(seccomp, action, id, 0);
+ }
+ if (r < 0)
+ return r;
+ }
+
+ return 0;
+}
+
+int seccomp_load_filter_set(uint32_t default_action, const SyscallFilterSet *set, uint32_t action) {
+ scmp_filter_ctx seccomp;
+ int r;
+
+ assert(set);
+
+ /* The one-stop solution: allocate a seccomp object, add a filter to it, and apply it */
+
+ r = seccomp_init_conservative(&seccomp, default_action);
+ if (r < 0)
+ return r;
+
+ r = seccomp_add_syscall_filter_set(seccomp, set, action);
+ if (r < 0)
+ goto finish;
+
+ r = seccomp_load(seccomp);
+
+finish:
+ seccomp_release(seccomp);
+ return r;
+
+}
diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h
index cca7c17912..8050fc6fbf 100644
--- a/src/shared/seccomp-util.h
+++ b/src/shared/seccomp-util.h
@@ -20,18 +20,45 @@
***/
#include <seccomp.h>
+#include <stdbool.h>
#include <stdint.h>
const char* seccomp_arch_to_string(uint32_t c);
int seccomp_arch_from_string(const char *n, uint32_t *ret);
-int seccomp_add_secondary_archs(scmp_filter_ctx *c);
+int seccomp_init_conservative(scmp_filter_ctx *ret, uint32_t default_action);
+
+int seccomp_add_secondary_archs(scmp_filter_ctx c);
bool is_seccomp_available(void);
-typedef struct SystemCallFilterSet {
- const char *set_name;
+typedef struct SyscallFilterSet {
+ const char *name;
const char *value;
-} SystemCallFilterSet;
+} SyscallFilterSet;
+
+enum {
+ SYSCALL_FILTER_SET_CLOCK,
+ SYSCALL_FILTER_SET_CPU_EMULATION,
+ SYSCALL_FILTER_SET_DEBUG,
+ SYSCALL_FILTER_SET_DEFAULT,
+ SYSCALL_FILTER_SET_IO_EVENT,
+ SYSCALL_FILTER_SET_IPC,
+ SYSCALL_FILTER_SET_KEYRING,
+ SYSCALL_FILTER_SET_MODULE,
+ SYSCALL_FILTER_SET_MOUNT,
+ SYSCALL_FILTER_SET_NETWORK_IO,
+ SYSCALL_FILTER_SET_OBSOLETE,
+ SYSCALL_FILTER_SET_PRIVILEGED,
+ SYSCALL_FILTER_SET_PROCESS,
+ SYSCALL_FILTER_SET_RAW_IO,
+ _SYSCALL_FILTER_SET_MAX
+};
+
+extern const SyscallFilterSet syscall_filter_sets[];
+
+const SyscallFilterSet *syscall_filter_set_find(const char *name);
+
+int seccomp_add_syscall_filter_set(scmp_filter_ctx seccomp, const SyscallFilterSet *set, uint32_t action);
-extern const SystemCallFilterSet syscall_filter_sets[];
+int seccomp_load_filter_set(uint32_t default_action, const SyscallFilterSet *set, uint32_t action);
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-13 04:08:23 +0000