netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Add additional mmap seccomp rule

Browse Source 
HostFileMapper.RegenerateMappings calls mmap with
MAP_SHARED|MAP_FIXED and these were not allowed.

Closes #6116

PiperOrigin-RevId: 377428463
This commit is contained in:
Fabricio Voznika
2021-06-03 20:07:55 -07:00
committed by gVisor bot
parent b3c608ef85
commit 86cf56eb71
2 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/seccomp/seccomp.go
+4 -8
View File
@@ -36,14 +36,10 @@ const (
// Install generates BPF code based on the set of syscalls provided. It only
// allows syscalls that conform to the specification. Syscalls that violate the
// specification will trigger RET_KILL_PROCESS, except for the cases below.
//
// RET_TRAP is used in violations, instead of RET_KILL_PROCESS, in the
// following cases:
// 1. Kernel doesn't support RET_KILL_PROCESS: RET_KILL_THREAD only kills the
// offending thread and often keeps the sentry hanging.
// 2. Debug: RET_TRAP generates a panic followed by a stack trace which is
// much easier to debug then RET_KILL_PROCESS which can't be caught.
// specification will trigger RET_KILL_PROCESS. If RET_KILL_PROCESS is not
// supported, violations will trigger RET_TRAP instead. RET_KILL_THREAD is not
// used because it only kills the offending thread and often keeps the sentry
// hanging.
//
// Be aware that RET_TRAP sends SIGSYS to the process and it may be ignored,
// making it possible for the process to continue running after a violation.
runsc/boot/filter/config.go
+6
View File
@@ -196,6 +196,12 @@ var allowedSyscalls = seccomp.SyscallRules{
seccomp.MatchAny{},
seccomp.EqualTo(unix.MAP_SHARED),
},
{
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.EqualTo(unix.MAP_SHARED | unix.MAP_FIXED),
},
{
seccomp.MatchAny{},
seccomp.MatchAny{},