From 2d5391af2c47dfc87d2a83885551f92359f303b2 Mon Sep 17 00:00:00 2001 From: Etienne Perot Date: Thu, 30 Nov 2023 10:23:54 -0800 Subject: [PATCH] `seccomp`: Compute cache individually for each task in the thread group. The cache may not be reusable across tasks in case the tasks' "arch audit number" (`t.image.st.AuditNumber`) is different. In practice this should ~never be the case, but recompute the cache anyway out of caution. PiperOrigin-RevId: 586716339 --- pkg/sentry/kernel/seccomp.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkg/sentry/kernel/seccomp.go b/pkg/sentry/kernel/seccomp.go index 515678e1c..b698e543f 100644 --- a/pkg/sentry/kernel/seccomp.go +++ b/pkg/sentry/kernel/seccomp.go @@ -297,7 +297,9 @@ func (t *Task) AppendSyscallFilter(p bpf.Program, syncAll bool) error { // Note: No new privs is always assumed to be set. for ot := t.tg.tasks.Front(); ot != nil; ot = ot.Next() { if ot != t { - ot.seccomp.Store(newSeccomp.copy()) + seccompCopy := newSeccomp.copy() + seccompCopy.populateCache(ot) + ot.seccomp.Store(seccompCopy) } } }