From 46833fbeee6ec745a89798cc5e567082c82032c6 Mon Sep 17 00:00:00 2001 From: Michael Pratt Date: Thu, 6 Mar 2025 09:51:12 -0800 Subject: [PATCH] Allow prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME) through syscall filters As of https://go.dev/cl/646095, the Go runtime calls prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME) when mapping memory to annotate mappings in /proc/self/maps. Since this is a system call made throughout the application lifetime, it needs to be allowed through the system call filters. PiperOrigin-RevId: 734182524 --- pkg/seccomp/victim/seccomp_test_victim.go | 1 + runsc/boot/filter/config/config_main.go | 21 ++++++++++++++------- runsc/fsgofer/filter/config.go | 13 ++++++++++--- 3 files changed, 25 insertions(+), 10 deletions(-) diff --git a/pkg/seccomp/victim/seccomp_test_victim.go b/pkg/seccomp/victim/seccomp_test_victim.go index 8d6e18e18..229c5cc69 100644 --- a/pkg/seccomp/victim/seccomp_test_victim.go +++ b/pkg/seccomp/victim/seccomp_test_victim.go @@ -68,6 +68,7 @@ func main() { unix.SYS_NANOSLEEP: seccomp.MatchAll{}, unix.SYS_OPENAT: seccomp.MatchAll{}, unix.SYS_PPOLL: seccomp.MatchAll{}, + unix.SYS_PRCTL: seccomp.MatchAll{}, unix.SYS_PREAD64: seccomp.MatchAll{}, unix.SYS_PSELECT6: seccomp.MatchAll{}, unix.SYS_PWRITE64: seccomp.MatchAll{}, diff --git a/runsc/boot/filter/config/config_main.go b/runsc/boot/filter/config/config_main.go index e7c611c23..d8592c433 100644 --- a/runsc/boot/filter/config/config_main.go +++ b/runsc/boot/filter/config/config_main.go @@ -210,13 +210,20 @@ var allowedSyscalls = seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{ unix.SYS_MUNMAP: seccomp.MatchAll{}, unix.SYS_NANOSLEEP: seccomp.MatchAll{}, unix.SYS_PPOLL: seccomp.MatchAll{}, - unix.SYS_PREAD64: seccomp.MatchAll{}, - unix.SYS_PREADV: seccomp.MatchAll{}, - unix.SYS_PREADV2: seccomp.MatchAll{}, - unix.SYS_PWRITE64: seccomp.MatchAll{}, - unix.SYS_PWRITEV: seccomp.MatchAll{}, - unix.SYS_PWRITEV2: seccomp.MatchAll{}, - unix.SYS_READ: seccomp.MatchAll{}, + unix.SYS_PRCTL: seccomp.PerArg{ + seccomp.EqualTo(unix.PR_SET_VMA), + seccomp.EqualTo(unix.PR_SET_VMA_ANON_NAME), + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + }, + unix.SYS_PREAD64: seccomp.MatchAll{}, + unix.SYS_PREADV: seccomp.MatchAll{}, + unix.SYS_PREADV2: seccomp.MatchAll{}, + unix.SYS_PWRITE64: seccomp.MatchAll{}, + unix.SYS_PWRITEV: seccomp.MatchAll{}, + unix.SYS_PWRITEV2: seccomp.MatchAll{}, + unix.SYS_READ: seccomp.MatchAll{}, unix.SYS_RECVMSG: seccomp.Or{ seccomp.PerArg{ seccomp.AnyValue{}, diff --git a/runsc/fsgofer/filter/config.go b/runsc/fsgofer/filter/config.go index 70e613088..0663ff321 100644 --- a/runsc/fsgofer/filter/config.go +++ b/runsc/fsgofer/filter/config.go @@ -135,9 +135,16 @@ var allowedSyscalls = seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{ unix.SYS_NANOSLEEP: seccomp.MatchAll{}, unix.SYS_OPENAT: seccomp.MatchAll{}, unix.SYS_PPOLL: seccomp.MatchAll{}, - unix.SYS_PREAD64: seccomp.MatchAll{}, - unix.SYS_PWRITE64: seccomp.MatchAll{}, - unix.SYS_READ: seccomp.MatchAll{}, + unix.SYS_PRCTL: seccomp.PerArg{ + seccomp.EqualTo(unix.PR_SET_VMA), + seccomp.EqualTo(unix.PR_SET_VMA_ANON_NAME), + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + }, + unix.SYS_PREAD64: seccomp.MatchAll{}, + unix.SYS_PWRITE64: seccomp.MatchAll{}, + unix.SYS_READ: seccomp.MatchAll{}, unix.SYS_RECVMSG: seccomp.Or{ seccomp.PerArg{ seccomp.AnyValue{},