netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Allow prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME) through syscall filters

Browse Source 
As of https://go.dev/cl/646095, the Go runtime calls
prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME) when mapping memory to annotate
mappings in /proc/self/maps. Since this is a system call made throughout the
application lifetime, it needs to be allowed through the system call filters.

PiperOrigin-RevId: 734182524
This commit is contained in:
Michael Pratt
2025-03-06 09:54:22 -08:00
committed by gVisor bot
parent 156f457e28
commit 46833fbeee
3 changed files with 25 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/seccomp/victim/seccomp_test_victim.go
+1
View File
@@ -68,6 +68,7 @@ func main() {
unix.SYS_NANOSLEEP: seccomp.MatchAll{},
unix.SYS_OPENAT: seccomp.MatchAll{},
unix.SYS_PPOLL: seccomp.MatchAll{},
unix.SYS_PRCTL: seccomp.MatchAll{},
unix.SYS_PREAD64: seccomp.MatchAll{},
unix.SYS_PSELECT6: seccomp.MatchAll{},
unix.SYS_PWRITE64: seccomp.MatchAll{},
runsc/boot/filter/config/config_main.go
+14 -7
View File
@@ -210,13 +210,20 @@ var allowedSyscalls = seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{
unix.SYS_MUNMAP: seccomp.MatchAll{},
unix.SYS_NANOSLEEP: seccomp.MatchAll{},
unix.SYS_PPOLL: seccomp.MatchAll{},
unix.SYS_PREAD64: seccomp.MatchAll{},
unix.SYS_PREADV: seccomp.MatchAll{},
unix.SYS_PREADV2: seccomp.MatchAll{},
unix.SYS_PWRITE64: seccomp.MatchAll{},
unix.SYS_PWRITEV: seccomp.MatchAll{},
unix.SYS_PWRITEV2: seccomp.MatchAll{},
unix.SYS_READ: seccomp.MatchAll{},
unix.SYS_PRCTL: seccomp.PerArg{
seccomp.EqualTo(unix.PR_SET_VMA),
seccomp.EqualTo(unix.PR_SET_VMA_ANON_NAME),
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
},
unix.SYS_PREAD64: seccomp.MatchAll{},
unix.SYS_PREADV: seccomp.MatchAll{},
unix.SYS_PREADV2: seccomp.MatchAll{},
unix.SYS_PWRITE64: seccomp.MatchAll{},
unix.SYS_PWRITEV: seccomp.MatchAll{},
unix.SYS_PWRITEV2: seccomp.MatchAll{},
unix.SYS_READ: seccomp.MatchAll{},
unix.SYS_RECVMSG: seccomp.Or{
seccomp.PerArg{
seccomp.AnyValue{},
runsc/fsgofer/filter/config.go
+10 -3
View File
@@ -135,9 +135,16 @@ var allowedSyscalls = seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{
unix.SYS_NANOSLEEP: seccomp.MatchAll{},
unix.SYS_OPENAT: seccomp.MatchAll{},
unix.SYS_PPOLL: seccomp.MatchAll{},
unix.SYS_PREAD64: seccomp.MatchAll{},
unix.SYS_PWRITE64: seccomp.MatchAll{},
unix.SYS_READ: seccomp.MatchAll{},
unix.SYS_PRCTL: seccomp.PerArg{
seccomp.EqualTo(unix.PR_SET_VMA),
seccomp.EqualTo(unix.PR_SET_VMA_ANON_NAME),
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
},
unix.SYS_PREAD64: seccomp.MatchAll{},
unix.SYS_PWRITE64: seccomp.MatchAll{},
unix.SYS_READ: seccomp.MatchAll{},
unix.SYS_RECVMSG: seccomp.Or{
seccomp.PerArg{
seccomp.AnyValue{},