seccomp: add support for Landlock syscalls in default policy #43199
Conversation
|
(CI failure appears unrelated, please correct me if wrong.) |
|
Maybe we should add all recent syscalls in a single PR? |
84232d3 to
52c3315
Compare
|
Whoops, forgot that they're not multiplexed from one syscall. Allowing more recent syscalls sounds good to me; I just didn't want to rock the boat too much in this PR. |
Xyene
changed the title
This commit allows the Landlock[0] system calls in the default seccomp policy. Landlock was introduced in kernel 5.13, to fill the gap that inspecting filepaths passed as arguments to filesystem system calls is not really possible with pure `seccomp` (unless involving `ptrace`). Allowing Landlock by default fits in with allowing `seccomp` for containerized applications to voluntarily restrict their access rights to files within the container. [0]: https://www.kernel.org/doc/html/latest/userspace-api/landlock.html Signed-off-by: Tudor Brindus <[email protected]>
|
We need to also verify there aren't any system calls in between these ones' numbers and what's already in the profile, right? |
|
thanks @tianon for the ping. I adapted a script I'd written a while ago into this: https://gist.github.com/mwhudson/d28706022141a0cb631328c3a1adad50 (using this handy python packge: https://github.com/hrw/python-syscalls). Running it on this PR produced this output: The removal of the landlock_* syscalls from the ENOSYS set is the point. Someone should thing about the mount_setattr and quotactl_fd changes though! (I think it would be awesome if someone could wrap up this script as a github action that posted to all PRs touching profiles/seccomp/default.json! I don't really know how to do that though) |
Calling my go-to buddy for everything GitHub actions @crazy-max |
|
Looks like we have approval on the seccomp changes itself; we can looks at automating the check separately 👍 |
7 participants
This commit allows the
landlocksystem call in the default seccomppolicy.
Landlock was introduced in kernel 5.13, to fill the gap that
inspecting filepaths passed as arguments to filesystem system calls is
not really possible with pure
seccomp(unless involvingptrace).Allowing
landlockby default fits in with allowingseccomp, forcontainerized applications to voluntarily restrict their access rights
to files within the container.