Skip to content

Commit 5765991

Browse files
stanislavlevinthaJeztah
stanislavlevin
authored and
thaJeztah
committed
seccomp: Whitelist clock_adjtime
This only allows making the syscall. CAP_SYS_TIME is still required for time adjustment (enforced by the kernel): ``` kernel/time/posix-timers.c: 1112 SYSCALL_DEFINE2(clock_adjtime, const clockid_t, which_clock, 1113 struct __kernel_timex __user *, utx) ... 1121 err = do_clock_adjtime(which_clock, &ktx); 1100 int do_clock_adjtime(const clockid_t which_clock, struct __kernel_timex * ktx) 1101 { ... 1109 return kc->clock_adj(which_clock, ktx); 1299 static const struct k_clock clock_realtime = { ... 1304 .clock_adj = posix_clock_realtime_adj, 188 static int posix_clock_realtime_adj(const clockid_t which_clock, 189 struct __kernel_timex *t) 190 { 191 return do_adjtimex(t); kernel/time/timekeeping.c: 2312 int do_adjtimex(struct __kernel_timex *txc) 2313 { ... 2321 /* Validate the data before disabling interrupts */ 2322 ret = timekeeping_validate_timex(txc); 2246 static int timekeeping_validate_timex(const struct __kernel_timex *txc) 2247 { 2248 if (txc->modes & ADJ_ADJTIME) { ... 2252 if (!(txc->modes & ADJ_OFFSET_READONLY) && 2253 !capable(CAP_SYS_TIME)) 2254 return -EPERM; 2255 } else { 2256 /* In order to modify anything, you gotta be super-user! */ 2257 if (txc->modes && !capable(CAP_SYS_TIME)) 2258 return -EPERM; ``` Fixes: moby/moby 40919 Signed-off-by: Stanislav Levin <[email protected]> Signed-off-by: Sebastiaan van Stijn <[email protected]>
1 parent b7cf3c6 commit 5765991

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

‎contrib/seccomp/seccomp_default.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,8 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp {
6464
"chmod",
6565
"chown",
6666
"chown32",
67+
"clock_adjtime",
68+
"clock_adjtime64",
6769
"clock_getres",
6870
"clock_getres_time64",
6971
"clock_gettime",

0 commit comments

Comments
 (0)