183 lines
5.6 KiB
Diff
183 lines
5.6 KiB
Diff
From f3daefee2a044dac912afccb52a724a7fe710caf Mon Sep 17 00:00:00 2001
|
|
From: wang--ge <wang__ge@126.com>
|
|
Date: Sat, 19 Nov 2022 15:43:51 +0800
|
|
Subject: [PATCH] honor seccomp errnoRet
|
|
|
|
---
|
|
libcontainer/configs/config.go | 1 +
|
|
libcontainer/integration/seccomp_test.go | 72 +++++++++++++++++++
|
|
libcontainer/seccomp/seccomp_linux.go | 12 +++-
|
|
libcontainer/specconv/spec_linux.go | 1 +
|
|
.../runtime-spec/specs-go/config.go | 1 +
|
|
5 files changed, 84 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/libcontainer/configs/config.go b/libcontainer/configs/config.go
|
|
index 9074c86..7dd4bde 100644
|
|
--- a/libcontainer/configs/config.go
|
|
+++ b/libcontainer/configs/config.go
|
|
@@ -78,6 +78,7 @@ type Arg struct {
|
|
type Syscall struct {
|
|
Name string `json:"name"`
|
|
Action Action `json:"action"`
|
|
+ ErrnoRet *uint `json:"errnoRet"`
|
|
Priority uint8 `json:"priority,omitempty"`
|
|
Args []*Arg `json:"args"`
|
|
}
|
|
diff --git a/libcontainer/integration/seccomp_test.go b/libcontainer/integration/seccomp_test.go
|
|
index 8e2c7cd..72d0d96 100644
|
|
--- a/libcontainer/integration/seccomp_test.go
|
|
+++ b/libcontainer/integration/seccomp_test.go
|
|
@@ -12,6 +12,78 @@ import (
|
|
libseccomp "github.com/seccomp/libseccomp-golang"
|
|
)
|
|
|
|
+func TestSeccompDenyGetcwdWithErrno(t *testing.T) {
|
|
+ if testing.Short() {
|
|
+ return
|
|
+ }
|
|
+
|
|
+ rootfs, err := newRootfs()
|
|
+ if err != nil {
|
|
+ t.Fatal(err)
|
|
+ }
|
|
+ defer remove(rootfs)
|
|
+
|
|
+ errnoRet := uint(syscall.ESRCH)
|
|
+
|
|
+ config := newTemplateConfig(rootfs)
|
|
+ config.Seccomp = &configs.Seccomp{
|
|
+ DefaultAction: configs.Allow,
|
|
+ Syscalls: []*configs.Syscall{
|
|
+ {
|
|
+ Name: "getcwd",
|
|
+ Action: configs.Errno,
|
|
+ ErrnoRet: &errnoRet,
|
|
+ },
|
|
+ },
|
|
+ }
|
|
+
|
|
+ container, err := newContainer(config)
|
|
+ if err != nil {
|
|
+ t.Fatal(err)
|
|
+ }
|
|
+ defer container.Destroy()
|
|
+
|
|
+ buffers := newStdBuffers()
|
|
+ pwd := &libcontainer.Process{
|
|
+ Cwd: "/",
|
|
+ Args: []string{"pwd"},
|
|
+ Env: standardEnvironment,
|
|
+ Stdin: buffers.Stdin,
|
|
+ Stdout: buffers.Stdout,
|
|
+ Stderr: buffers.Stderr,
|
|
+ Init: true,
|
|
+ }
|
|
+
|
|
+ err = container.Run(pwd)
|
|
+ if err != nil {
|
|
+ t.Fatal(err)
|
|
+ }
|
|
+ ps, err := pwd.Wait()
|
|
+ if err == nil {
|
|
+ t.Fatal("Expecting error (negative return code); instead exited cleanly!")
|
|
+ }
|
|
+
|
|
+ var exitCode int
|
|
+ status := ps.Sys().(syscall.WaitStatus)
|
|
+ if status.Exited() {
|
|
+ exitCode = status.ExitStatus()
|
|
+ } else if status.Signaled() {
|
|
+ exitCode = -int(status.Signal())
|
|
+ } else {
|
|
+ t.Fatalf("Unrecognized exit reason!")
|
|
+ }
|
|
+
|
|
+ if exitCode == 0 {
|
|
+ t.Fatalf("Getcwd should fail with negative exit code, instead got %d!", exitCode)
|
|
+ }
|
|
+
|
|
+ expected := "pwd: getcwd: No such process"
|
|
+ actual := strings.Trim(buffers.Stderr.String(), "\n")
|
|
+ if actual != expected {
|
|
+ t.Fatalf("Expected output %s but got %s\n", expected, actual)
|
|
+ }
|
|
+}
|
|
+
|
|
func TestSeccompDenyGetcwd(t *testing.T) {
|
|
if testing.Short() {
|
|
return
|
|
diff --git a/libcontainer/seccomp/seccomp_linux.go b/libcontainer/seccomp/seccomp_linux.go
|
|
index 0c97da6..26cec43 100644
|
|
--- a/libcontainer/seccomp/seccomp_linux.go
|
|
+++ b/libcontainer/seccomp/seccomp_linux.go
|
|
@@ -36,7 +36,7 @@ func InitSeccomp(config *configs.Seccomp) error {
|
|
return fmt.Errorf("cannot initialize Seccomp - nil config passed")
|
|
}
|
|
|
|
- defaultAction, err := getAction(config.DefaultAction)
|
|
+ defaultAction, err := getAction(config.DefaultAction, nil)
|
|
if err != nil {
|
|
return fmt.Errorf("error initializing seccomp - invalid default action")
|
|
}
|
|
@@ -100,17 +100,23 @@ func IsEnabled() bool {
|
|
}
|
|
|
|
// Convert Libcontainer Action to Libseccomp ScmpAction
|
|
-func getAction(act configs.Action) (libseccomp.ScmpAction, error) {
|
|
+func getAction(act configs.Action, errnoRet *uint) (libseccomp.ScmpAction, error) {
|
|
switch act {
|
|
case configs.Kill:
|
|
return actKill, nil
|
|
case configs.Errno:
|
|
+ if errnoRet != nil {
|
|
+ return libseccomp.ActErrno.SetReturnCode(int16(*errnoRet)), nil
|
|
+ }
|
|
return actErrno, nil
|
|
case configs.Trap:
|
|
return actTrap, nil
|
|
case configs.Allow:
|
|
return actAllow, nil
|
|
case configs.Trace:
|
|
+ if errnoRet != nil {
|
|
+ return libseccomp.ActTrace.SetReturnCode(int16(*errnoRet)), nil
|
|
+ }
|
|
return actTrace, nil
|
|
default:
|
|
return libseccomp.ActInvalid, fmt.Errorf("invalid action, cannot use in rule")
|
|
@@ -173,7 +179,7 @@ func matchCall(filter *libseccomp.ScmpFilter, call *configs.Syscall) error {
|
|
}
|
|
|
|
// Convert the call's action to the libseccomp equivalent
|
|
- callAct, err := getAction(call.Action)
|
|
+ callAct, err := getAction(call.Action, call.ErrnoRet)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go
|
|
index 0cbc66f..8177739 100644
|
|
--- a/libcontainer/specconv/spec_linux.go
|
|
+++ b/libcontainer/specconv/spec_linux.go
|
|
@@ -758,6 +758,7 @@ func setupSeccomp(config *specs.LinuxSeccomp) (*configs.Seccomp, error) {
|
|
newCall := configs.Syscall{
|
|
Name: name,
|
|
Action: newAction,
|
|
+ ErrnoRet: call.ErrnoRet,
|
|
Priority: call.Priority,
|
|
Args: []*configs.Arg{},
|
|
}
|
|
diff --git a/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go b/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go
|
|
index 8439744..ec8096a 100644
|
|
--- a/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go
|
|
+++ b/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go
|
|
@@ -556,6 +556,7 @@ type LinuxSeccompArg struct {
|
|
type LinuxSyscall struct {
|
|
Names []string `json:"names"`
|
|
Action LinuxSeccompAction `json:"action"`
|
|
+ ErrnoRet *uint `json:"errnoRet,omitempty"`
|
|
Priority uint8 `json:"priority,omitempty"`
|
|
Args []LinuxSeccompArg `json:"args"`
|
|
Comment string `json:"comment"`
|
|
--
|
|
2.27.0
|
|
|