[1.1] seccomp: patchbpf: always include native architecture in stub #4391
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
(This is a cherry-pick of 2cd05e4.) In findLastSyscalls, we convert libseccomp.ArchNative to the real libseccomp architecture, but archToNative already does that, so this code is redundant. Remove the redundant code, and move its comment to archToNative. Fixes: 7a8d716 ("seccomp: prepend -ENOSYS stub to all filters") Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
(This is a backport of b288abe.) Calling the Linux AUDIT_* architecture constants "native" leads to confusing code when we are getting the actual native architecture of the running system. Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
(This is a backport of ccc500c.) It turns out that on ppc64le (at least), Docker doesn't include any architectures in the list of allowed architectures. libseccomp interprets this as "just include the default architecture" but patchbpf would return a no-op ENOSYS stub, which would lead to the exact issues that commit 7a8d716 ("seccomp: prepend -ENOSYS stub to all filters") fixed for other architectures. So, just always include the running architecture in the list. There's no real downside. Ref: https://bugzilla.suse.com/show_bug.cgi?id=1192051#c6 Fixes: 7a8d716 ("seccomp: prepend -ENOSYS stub to all filters") Reported-by: Fabian Vogt <fvogt@suse.com> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
|
I forgot to include this for 1.1.14 (we have backports of this for the SLES runc package). 😅 |
rata
approved these changes
Sep 10, 2024
Comment on lines
+235
to
+238
| // On architectures like ppc64le, Docker inexplicably doesn't include the | ||
| // native architecture in the architecture list which results in no | ||
| // architectures being present in the list at all (rendering the ENOSYS | ||
| // stub a no-op). So, always include the native architecture. |
There was a problem hiding this comment.
Can we report this to upstream docker? (besides keeping this code, of course)
There was a problem hiding this comment.
Opened moby/moby#48471. It's a bit light on the details but I linked to the SUSE bug where I debugged this earlier this year.
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport of #4219 and #3635.
It turns out that on ppc64le (at least), Docker doesn't include any
architectures in the list of allowed architectures. libseccomp
interprets this as "just include the default architecture" but patchbpf
would return a no-op ENOSYS stub, which would lead to the exact issues
that commit 7a8d716 ("seccomp: prepend -ENOSYS stub to all
filters") fixed for other architectures.
So, just always include the running architecture in the list. There's
no real downside.
Ref: https://bugzilla.suse.com/show_bug.cgi?id=1192051#c6
Reported-by: Fabian Vogt fvogt@suse.com
Signed-off-by: Aleksa Sarai cyphar@cyphar.com