From 58a124b36a080df057c538aef14d4e4f0a58f5bb Mon Sep 17 00:00:00 2001 From: David Roberts Date: Fri, 4 Jan 2019 13:15:27 +0000 Subject: [PATCH 1/3] [ML] Update seccomp filter for Fedora 29 Fedora 29 uses different system calls to platforms we've previously tested on, and hence suffers from certain functionality failing due to the seccomp filter. This commit permits 3 additional system calls: 1. __NR_gettimeofday 2. __NR_unlinkat 3. __NR_getdents64 (It is likely that other Linux distributions using modern glibc would also hit one or more of these system calls. Non-fatal problems probably got progressively worse in the lead up to the fatal problem that surfaced in Fedora 29.) Fixes #350 --- lib/seccomp/CSystemCallFilter_Linux.cc | 41 ++++++++++++++------------ 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/lib/seccomp/CSystemCallFilter_Linux.cc b/lib/seccomp/CSystemCallFilter_Linux.cc index 593e012388..2ed1cd7d0e 100644 --- a/lib/seccomp/CSystemCallFilter_Linux.cc +++ b/lib/seccomp/CSystemCallFilter_Linux.cc @@ -51,30 +51,33 @@ const struct sock_filter FILTER[] = { // Load the system call number into accumulator BPF_STMT(BPF_LD | BPF_W | BPF_ABS, SECCOMP_DATA_NR_OFFSET), // Only applies to X86_64 arch. Jump to disallow for calls using the x32 ABI - BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, UPPER_NR_LIMIT, 36, 0), + BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, UPPER_NR_LIMIT, 39, 0), // If any sys call filters are added or removed then the jump // destination for each statement including the one above must // be updated accordingly // Allowed sys calls, jump to return allow on match - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_read, 36, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 35, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_writev, 34, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_lseek, 33, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_lstat, 32, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_clock_gettime, 31, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_readlink, 30, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_stat, 29, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fstat, 28, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_open, 27, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_close, 26, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_connect, 25, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_clone, 24, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_statfs, 23, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_dup2, 22, 0), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mkdir, 21, 0), // for forecast temp storage - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_rmdir, 20, 0), // for forecast temp storage - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_getdents, 19, 0), // for forecast temp storage + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_read, 39, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 38, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_writev, 37, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_lseek, 36, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_lstat, 35, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_clock_gettime, 34, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_gettimeofday, 33, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_readlink, 32, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_stat, 31, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fstat, 30, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_open, 29, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_close, 28, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_connect, 27, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_clone, 26, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_statfs, 25, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_dup2, 24, 0), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mkdir, 23, 0), // for forecast temp storage + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_rmdir, 22, 0), // for forecast temp storage + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_unlinkat, 21, 0), // for forecast temp storage + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_getdents, 20, 0), // for forecast temp storage + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_getdents64, 19, 0), // for forecast temp storage BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_openat, 18, 0), // for forecast temp storage BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_tgkill, 17, 0), // for the crash handler BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_rt_sigaction, 16, 0), // for the crash handler From f7b1bf7e28dcb9443f6e1e3f1f5a27737dfabd55 Mon Sep 17 00:00:00 2001 From: David Roberts Date: Fri, 4 Jan 2019 13:26:16 +0000 Subject: [PATCH 2/3] Update changelog --- docs/CHANGELOG.asciidoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/CHANGELOG.asciidoc b/docs/CHANGELOG.asciidoc index 0457cd4191..be52366b21 100644 --- a/docs/CHANGELOG.asciidoc +++ b/docs/CHANGELOG.asciidoc @@ -37,3 +37,9 @@ == {es} version 7.0.0-alpha1 +== {es} version 6.7.0 + +=== Enhancements + +* Adjust seccomp filter for Fedora 29. {ml-pull}354[#354] + From 1df24cb325b8256d0a5ce2ef4909225b866ce17b Mon Sep 17 00:00:00 2001 From: David Roberts Date: Fri, 4 Jan 2019 14:23:12 +0000 Subject: [PATCH 3/3] Remove unnecessary architecture check Since the filter is being installed by native code that will only work on one architecture, there is no need to check the architecture as part of the filter. --- lib/seccomp/CSystemCallFilter_Linux.cc | 6 ------ 1 file changed, 6 deletions(-) diff --git a/lib/seccomp/CSystemCallFilter_Linux.cc b/lib/seccomp/CSystemCallFilter_Linux.cc index 2ed1cd7d0e..25ed339c18 100644 --- a/lib/seccomp/CSystemCallFilter_Linux.cc +++ b/lib/seccomp/CSystemCallFilter_Linux.cc @@ -26,8 +26,6 @@ const std::uint32_t UPPER_NR_LIMIT = 0x3FFFFFFF; // Offset to the nr field in struct seccomp_data const std::uint32_t SECCOMP_DATA_NR_OFFSET = 0x00; -// Offset to the arch field in struct seccomp_data -const std::uint32_t SECCOMP_DATA_ARCH_OFFSET = 0x04; // Copied from seccomp.h // seccomp.h cannot be included as it was added in Linux kernel 3.17 @@ -44,10 +42,6 @@ const std::uint32_t SECCOMP_DATA_ARCH_OFFSET = 0x04; #endif const struct sock_filter FILTER[] = { - // Load architecture from 'seccomp_data' buffer into accumulator - BPF_STMT(BPF_LD | BPF_W | BPF_ABS, SECCOMP_DATA_ARCH_OFFSET), - // Jump to disallow if architecture is not X86_64 - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, AUDIT_ARCH_X86_64, 0, 5), // Load the system call number into accumulator BPF_STMT(BPF_LD | BPF_W | BPF_ABS, SECCOMP_DATA_NR_OFFSET), // Only applies to X86_64 arch. Jump to disallow for calls using the x32 ABI