diff --git a/examples/seccheck/server.cc b/examples/seccheck/server.cc index 5943733de..42f604092 100644 --- a/examples/seccheck/server.cc +++ b/examples/seccheck/server.cc @@ -105,6 +105,14 @@ std::vector dispatchers = { unpackSyscall<::gvisor::syscall::Clone>, unpackSyscall<::gvisor::syscall::Bind>, unpackSyscall<::gvisor::syscall::Accept>, + unpackSyscall<::gvisor::syscall::TimerfdCreate>, + unpackSyscall<::gvisor::syscall::TimerfdSetTime>, + unpackSyscall<::gvisor::syscall::TimerfdGetTime>, + unpackSyscall<::gvisor::syscall::Fork>, + unpackSyscall<::gvisor::syscall::InotifyInit>, + unpackSyscall<::gvisor::syscall::InotifyAddWatch>, + unpackSyscall<::gvisor::syscall::InotifyRmWatch>, + unpackSyscall<::gvisor::syscall::SocketPair>, }; void unpack(absl::string_view buf) { diff --git a/pkg/sentry/seccheck/metadata_amd64.go b/pkg/sentry/seccheck/metadata_amd64.go index 5f889904f..c7e405592 100644 --- a/pkg/sentry/seccheck/metadata_amd64.go +++ b/pkg/sentry/seccheck/metadata_amd64.go @@ -139,6 +139,36 @@ func init() { Name: "fd_path", }, }) + addSyscallPoint(57, "fork", nil) + addSyscallPoint(58, "vfork", nil) + addSyscallPoint(253, "inotify_init", nil) + addSyscallPoint(294, "inotify_init1", nil) + addSyscallPoint(254, "inotify_add_watch", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(255, "inotify_rm_watch", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(283, "timerfd_create", nil) + addSyscallPoint(286, "timerfd_settime", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(287, "timerfd_gettime", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(53, "socketpair", nil) const lastSyscallInTable = 441 for i := 0; i <= lastSyscallInTable; i++ { diff --git a/pkg/sentry/seccheck/metadata_arm64.go b/pkg/sentry/seccheck/metadata_arm64.go index c4c42e30c..7179044ec 100644 --- a/pkg/sentry/seccheck/metadata_arm64.go +++ b/pkg/sentry/seccheck/metadata_arm64.go @@ -118,6 +118,34 @@ func init() { Name: "fd_path", }, }) + addSyscallPoint(26, "inotify_init1", nil) + addSyscallPoint(27, "inotify_add_watch", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(28, "inotify_rm_watch", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(85, "timerfd_create", nil) + addSyscallPoint(86, "timerfd_settime", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(87, "timerfd_gettime", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(199, "socketpair", nil) + const lastSyscallInTable = 441 for i := 0; i <= lastSyscallInTable; i++ { addRawSyscallPoint(uintptr(i)) diff --git a/pkg/sentry/seccheck/points/common.proto b/pkg/sentry/seccheck/points/common.proto index 5bd7ace13..19e144f8e 100644 --- a/pkg/sentry/seccheck/points/common.proto +++ b/pkg/sentry/seccheck/points/common.proto @@ -123,5 +123,13 @@ enum MessageType { MESSAGE_SYSCALL_CLONE = 23; MESSAGE_SYSCALL_BIND = 24; MESSAGE_SYSCALL_ACCEPT = 25; + MESSAGE_SYSCALL_TIMERFD_CREATE = 26; + MESSAGE_SYSCALL_TIMERFD_SETTIME = 27; + MESSAGE_SYSCALL_TIMERFD_GETTIME = 28; + MESSAGE_SYSCALL_FORK = 29; + MESSAGE_SYSCALL_INOTIFY_INIT = 30; + MESSAGE_SYSCALL_INOTIFY_ADD_WATCH = 31; + MESSAGE_SYSCALL_INOTIFY_RM_WATCH = 32; + MESSAGE_SYSCALL_SOCKETPAIR = 33; } // LINT.ThenChange(../../../../examples/seccheck/server.cc) diff --git a/pkg/sentry/seccheck/points/syscall.proto b/pkg/sentry/seccheck/points/syscall.proto index 41ff3fbc7..634e6646f 100644 --- a/pkg/sentry/seccheck/points/syscall.proto +++ b/pkg/sentry/seccheck/points/syscall.proto @@ -178,6 +178,7 @@ message Chroot { uint64 sysno = 3; string pathname = 4; } + message Eventfd { gvisor.common.ContextData context_data = 1; Exit exit = 2; @@ -214,3 +215,84 @@ message Accept { bytes address = 6; int32 flags = 7; } + +message TimerfdCreate { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 clock_id = 4; + int32 flags = 5; +} + +message Timespec { + int64 sec = 1; + int64 nsec = 2; +} + +message ItimerSpec { + Timespec interval = 1; + Timespec value = 2; +} + +message TimerfdSetTime { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 fd = 4; + string fd_path = 5; + int32 flags = 6; + ItimerSpec new_value = 7; + ItimerSpec old_value = 8; +} + +message TimerfdGetTime { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 fd = 4; + string fd_path = 5; + ItimerSpec cur_value = 6; +} + +message Fork { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; +} + +message InotifyInit { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 flags = 4; +} + +message InotifyAddWatch{ + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 fd = 4; + string fd_path = 5; + string pathname = 6; + uint32 mask = 7; +} + +message InotifyRmWatch { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 fd = 4; + string fd_path = 5; + int32 wd = 6; +} + +message SocketPair { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 domain = 4; + int32 type = 5; + int32 protocol = 6; + int32 socket1 = 7; + int32 socket2 = 8; +} diff --git a/pkg/sentry/syscalls/linux/linux64.go b/pkg/sentry/syscalls/linux/linux64.go index 3d52498c6..3399cba2d 100644 --- a/pkg/sentry/syscalls/linux/linux64.go +++ b/pkg/sentry/syscalls/linux/linux64.go @@ -105,12 +105,12 @@ var AMD64 = &kernel.SyscallTable{ 50: syscalls.Supported("listen", Listen), 51: syscalls.Supported("getsockname", GetSockName), 52: syscalls.Supported("getpeername", GetPeerName), - 53: syscalls.Supported("socketpair", SocketPair), + 53: syscalls.SupportedPoint("socketpair", SocketPair, PointSocketpair), 54: syscalls.PartiallySupported("setsockopt", SetSockOpt, "Not all socket options are supported.", nil), 55: syscalls.PartiallySupported("getsockopt", GetSockOpt, "Not all socket options are supported.", nil), 56: syscalls.PartiallySupportedPoint("clone", Clone, PointClone, "Mount namespace (CLONE_NEWNS) not supported. Options CLONE_PARENT, CLONE_SYSVSEM not supported.", nil), - 57: syscalls.Supported("fork", Fork), - 58: syscalls.Supported("vfork", Vfork), + 57: syscalls.SupportedPoint("fork", Fork, PointFork), + 58: syscalls.SupportedPoint("vfork", Vfork, PointVfork), 59: syscalls.SupportedPoint("execve", Execve, PointExecve), 60: syscalls.Supported("exit", Exit), 61: syscalls.Supported("wait4", Wait4), @@ -305,9 +305,9 @@ var AMD64 = &kernel.SyscallTable{ 250: syscalls.Error("keyctl", linuxerr.EACCES, "Not available to user.", nil), 251: syscalls.CapError("ioprio_set", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_nice or cap_sys_admin (depending) 252: syscalls.CapError("ioprio_get", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_nice or cap_sys_admin (depending) - 253: syscalls.PartiallySupported("inotify_init", InotifyInit, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), - 254: syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), - 255: syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), + 253: syscalls.PartiallySupportedPoint("inotify_init", InotifyInit, PointInotifyInit, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), + 254: syscalls.PartiallySupportedPoint("inotify_add_watch", InotifyAddWatch, PointInotifyAddWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), + 255: syscalls.PartiallySupportedPoint("inotify_rm_watch", InotifyRmWatch, PointInotifyRmWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), 256: syscalls.CapError("migrate_pages", linux.CAP_SYS_NICE, "", nil), 257: syscalls.SupportedPoint("openat", Openat, PointOpenat), 258: syscalls.Supported("mkdirat", Mkdirat), @@ -335,18 +335,18 @@ var AMD64 = &kernel.SyscallTable{ 280: syscalls.Supported("utimensat", Utimensat), 281: syscalls.Supported("epoll_pwait", EpollPwait), 282: syscalls.PartiallySupportedPoint("signalfd", Signalfd, PointSignalfd, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}), - 283: syscalls.Supported("timerfd_create", TimerfdCreate), + 283: syscalls.SupportedPoint("timerfd_create", TimerfdCreate, PointTimerfdCreate), 284: syscalls.SupportedPoint("eventfd", Eventfd, PointEventfd), 285: syscalls.PartiallySupported("fallocate", Fallocate, "Not all options are supported.", nil), - 286: syscalls.Supported("timerfd_settime", TimerfdSettime), - 287: syscalls.Supported("timerfd_gettime", TimerfdGettime), + 286: syscalls.SupportedPoint("timerfd_settime", TimerfdSettime, PointTimerfdSettime), + 287: syscalls.SupportedPoint("timerfd_gettime", TimerfdGettime, PointTimerfdGettime), 288: syscalls.SupportedPoint("accept4", Accept4, PointAccept4), 289: syscalls.PartiallySupportedPoint("signalfd4", Signalfd4, PointSignalfd4, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}), 290: syscalls.SupportedPoint("eventfd2", Eventfd2, PointEventfd2), 291: syscalls.Supported("epoll_create1", EpollCreate1), 292: syscalls.SupportedPoint("dup3", Dup3, PointDup3), 293: syscalls.SupportedPoint("pipe2", Pipe2, PointPipe2), - 294: syscalls.PartiallySupported("inotify_init1", InotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), + 294: syscalls.PartiallySupportedPoint("inotify_init1", InotifyInit1, PointInotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), 295: syscalls.Supported("preadv", Preadv), 296: syscalls.Supported("pwritev", Pwritev), 297: syscalls.Supported("rt_tgsigqueueinfo", RtTgsigqueueinfo), @@ -456,9 +456,9 @@ var ARM64 = &kernel.SyscallTable{ 23: syscalls.SupportedPoint("dup", Dup, PointDup), 24: syscalls.SupportedPoint("dup3", Dup3, PointDup3), 25: syscalls.PartiallySupportedPoint("fcntl", Fcntl, PointFcntl, "Not all options are supported.", nil), - 26: syscalls.PartiallySupported("inotify_init1", InotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), - 27: syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), - 28: syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), + 26: syscalls.PartiallySupportedPoint("inotify_init1", InotifyInit1, PointInotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), + 27: syscalls.PartiallySupportedPoint("inotify_add_watch", InotifyAddWatch, PointInotifyAddWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), + 28: syscalls.PartiallySupportedPoint("inotify_rm_watch", InotifyRmWatch, PointInotifyRmWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), 29: syscalls.PartiallySupported("ioctl", Ioctl, "Only a few ioctls are implemented for backing devices and file systems.", nil), 30: syscalls.CapError("ioprio_set", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_nice or cap_sys_admin (depending) 31: syscalls.CapError("ioprio_get", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_nice or cap_sys_admin (depending) @@ -515,9 +515,9 @@ var ARM64 = &kernel.SyscallTable{ 82: syscalls.PartiallySupported("fsync", Fsync, "Full data flush is not guaranteed at this time.", nil), 83: syscalls.PartiallySupported("fdatasync", Fdatasync, "Full data flush is not guaranteed at this time.", nil), 84: syscalls.PartiallySupported("sync_file_range", SyncFileRange, "Full data flush is not guaranteed at this time.", nil), - 85: syscalls.Supported("timerfd_create", TimerfdCreate), - 86: syscalls.Supported("timerfd_settime", TimerfdSettime), - 87: syscalls.Supported("timerfd_gettime", TimerfdGettime), + 85: syscalls.SupportedPoint("timerfd_create", TimerfdCreate, PointTimerfdCreate), + 86: syscalls.SupportedPoint("timerfd_settime", TimerfdSettime, PointTimerfdSettime), + 87: syscalls.SupportedPoint("timerfd_gettime", TimerfdGettime, PointTimerfdGettime), 88: syscalls.Supported("utimensat", Utimensat), 89: syscalls.CapError("acct", linux.CAP_SYS_PACCT, "", nil), 90: syscalls.Supported("capget", Capget), @@ -629,7 +629,7 @@ var ARM64 = &kernel.SyscallTable{ 196: syscalls.PartiallySupported("shmat", Shmat, "Option SHM_RND is not supported.", nil), 197: syscalls.Supported("shmdt", Shmdt), 198: syscalls.PartiallySupported("socket", Socket, "Limited support for AF_NETLINK, NETLINK_ROUTE sockets. Limited support for SOCK_RAW.", nil), - 199: syscalls.Supported("socketpair", SocketPair), + 199: syscalls.SupportedPoint("socketpair", SocketPair, PointSocketpair), 200: syscalls.PartiallySupportedPoint("bind", Bind, PointBind, "Autobind for abstract Unix sockets is not supported.", nil), 201: syscalls.Supported("listen", Listen), 202: syscalls.SupportedPoint("accept", Accept, PointAccept), diff --git a/pkg/sentry/syscalls/linux/points.go b/pkg/sentry/syscalls/linux/points.go index 7fdc6527c..e585a3e77 100644 --- a/pkg/sentry/syscalls/linux/points.go +++ b/pkg/sentry/syscalls/linux/points.go @@ -629,3 +629,189 @@ func PointAccept4(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextD flags := info.Args[3].Int() return acceptHelper(t, fields, cxtData, info, flags) } + +// PointTimerfdCreate converts timerfd_create(2) syscall to proto. +func PointTimerfdCreate(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.TimerfdCreate{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + ClockId: info.Args[0].Int(), + Flags: info.Args[1].Int(), + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_TIMERFD_CREATE +} + +func getValues(values linux.Timespec) *pb.Timespec { + return &pb.Timespec{ + Sec: values.Sec, + Nsec: values.Nsec, + } +} + +// PointTimerfdSettime converts timerfd_settime(2) syscall to proto. +func PointTimerfdSettime(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.TimerfdSetTime{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Fd: info.Args[0].Int(), + Flags: info.Args[1].Int(), + } + + if fields.Local.Contains(seccheck.FieldSyscallPath) { + p.FdPath = getFilePath(t, int32(p.Fd)) + } + + var newVal linux.Itimerspec + if newValAddr := info.Args[2].Pointer(); newValAddr != 0 { + if _, err := newVal.CopyIn(t, newValAddr); err == nil { + p.NewValue = &pb.ItimerSpec{ + Interval: getValues(newVal.Interval), + Value: getValues(newVal.Value), + } + } + } + if info.Exit { + var oldVal linux.Itimerspec + if oldValAddr := info.Args[3].Pointer(); oldValAddr != 0 { + if _, err := oldVal.CopyIn(t, oldValAddr); err == nil { + p.OldValue = &pb.ItimerSpec{ + Interval: getValues(oldVal.Interval), + Value: getValues(oldVal.Value), + } + } + } + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_TIMERFD_SETTIME +} + +// PointTimerfdGettime converts timerfd_gettime(2) syscall to proto. +func PointTimerfdGettime(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.TimerfdGetTime{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Fd: info.Args[0].Int(), + } + + if fields.Local.Contains(seccheck.FieldSyscallPath) { + p.FdPath = getFilePath(t, int32(p.Fd)) + } + + if curValAddr := info.Args[1].Pointer(); curValAddr != 0 { + var curVal linux.Itimerspec + if _, err := curVal.CopyIn(t, curValAddr); err == nil { + p.CurValue = &pb.ItimerSpec{ + Interval: getValues(curVal.Interval), + Value: getValues(curVal.Value), + } + } + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_TIMERFD_GETTIME +} + +// pointForkHelper converts fork(2) and vfork(2) syscall to proto. +func pointForkHelper(cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.Fork{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_FORK +} + +// PointFork converts fork(2) syscall to proto. +func PointFork(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + return pointForkHelper(cxtData, info) +} + +// PointVfork converts vfork(2) syscall to proto. +func PointVfork(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + return pointForkHelper(cxtData, info) +} + +// pointInotifyInitHelper converts inotify_init(2) and inotify_init1(2) syscall to proto. +func pointInotifyInitHelper(cxtData *pb.ContextData, info kernel.SyscallInfo, flags int32) (proto.Message, pb.MessageType) { + p := &pb.InotifyInit{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Flags: flags, + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_INOTIFY_INIT +} + +// PointInotifyInit converts inotify_init(2) syscall to proto. +func PointInotifyInit(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + return pointInotifyInitHelper(cxtData, info, 0) +} + +// PointInotifyInit1 converts inotify_init1(2) syscall to proto. +func PointInotifyInit1(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + flags := info.Args[0].Int() + return pointInotifyInitHelper(cxtData, info, flags) +} + +// PointInotifyAddWatch converts inotify_add_watch(2) syscall to proto. +func PointInotifyAddWatch(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.InotifyAddWatch{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Fd: info.Args[0].Int(), + Mask: info.Args[2].Uint(), + } + if pathAddr := info.Args[1].Pointer(); pathAddr > 0 { + p.Pathname, _ = t.CopyInString(pathAddr, linux.PATH_MAX) + } + + if fields.Local.Contains(seccheck.FieldSyscallPath) { + p.FdPath = getFilePath(t, int32(p.Fd)) + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_INOTIFY_ADD_WATCH +} + +// PointInotifyRmWatch converts inotify_add_watch(2) syscall to proto. +func PointInotifyRmWatch(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.InotifyRmWatch{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Fd: info.Args[0].Int(), + Wd: info.Args[2].Int(), + } + + if fields.Local.Contains(seccheck.FieldSyscallPath) { + p.FdPath = getFilePath(t, int32(p.Fd)) + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_INOTIFY_RM_WATCH +} + +// PointSocketpair converts socketpair(2) syscall to proto. +func PointSocketpair(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.SocketPair{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Domain: info.Args[0].Int(), + Type: info.Args[1].Int(), + Protocol: info.Args[2].Int(), + } + if info.Exit { + sockets := info.Args[3].Pointer() + var fds [2]int32 + if _, err := primitive.CopyInt32SliceIn(t, sockets, fds[:]); err == nil { // if NO error + p.Socket1 = fds[0] + p.Socket2 = fds[1] + } + } + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_SOCKETPAIR +} diff --git a/pkg/sentry/syscalls/linux/vfs2/vfs2.go b/pkg/sentry/syscalls/linux/vfs2/vfs2.go index fe4d98312..115bed9bf 100644 --- a/pkg/sentry/syscalls/linux/vfs2/vfs2.go +++ b/pkg/sentry/syscalls/linux/vfs2/vfs2.go @@ -57,7 +57,7 @@ func Override() { s.Table[50] = syscalls.Supported("listen", Listen) s.Table[51] = syscalls.Supported("getsockname", GetSockName) s.Table[52] = syscalls.Supported("getpeername", GetPeerName) - s.Table[53] = syscalls.Supported("socketpair", SocketPair) + s.Table[53] = syscalls.SupportedPoint("socketpair", SocketPair, linux.PointSocketpair) s.Table[54] = syscalls.Supported("setsockopt", SetSockOpt) s.Table[55] = syscalls.Supported("getsockopt", GetSockOpt) s.Table[59] = syscalls.SupportedPoint("execve", Execve, linux.PointExecve) @@ -115,9 +115,9 @@ func Override() { s.Table[235] = syscalls.Supported("utimes", Utimes) s.Table[240] = syscalls.Supported("mq_open", MqOpen) s.Table[241] = syscalls.Supported("mq_unlink", MqUnlink) - s.Table[253] = syscalls.PartiallySupported("inotify_init", InotifyInit, "inotify events are only available inside the sandbox.", nil) - s.Table[254] = syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "inotify events are only available inside the sandbox.", nil) - s.Table[255] = syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "inotify events are only available inside the sandbox.", nil) + s.Table[253] = syscalls.PartiallySupportedPoint("inotify_init", InotifyInit, linux.PointInotifyInit, "inotify events are only available inside the sandbox.", nil) + s.Table[254] = syscalls.PartiallySupportedPoint("inotify_add_watch", InotifyAddWatch, linux.PointInotifyAddWatch, "inotify events are only available inside the sandbox.", nil) + s.Table[255] = syscalls.PartiallySupportedPoint("inotify_rm_watch", InotifyRmWatch, linux.PointInotifyRmWatch, "inotify events are only available inside the sandbox.", nil) s.Table[257] = syscalls.SupportedPoint("openat", Openat, linux.PointOpenat) s.Table[258] = syscalls.Supported("mkdirat", Mkdirat) s.Table[259] = syscalls.Supported("mknodat", Mknodat) @@ -139,18 +139,18 @@ func Override() { s.Table[280] = syscalls.Supported("utimensat", Utimensat) s.Table[281] = syscalls.Supported("epoll_pwait", EpollPwait) s.Table[282] = syscalls.SupportedPoint("signalfd", Signalfd, linux.PointSignalfd) - s.Table[283] = syscalls.Supported("timerfd_create", TimerfdCreate) + s.Table[283] = syscalls.SupportedPoint("timerfd_create", TimerfdCreate, linux.PointTimerfdCreate) s.Table[284] = syscalls.SupportedPoint("eventfd", Eventfd, linux.PointEventfd) s.Table[285] = syscalls.PartiallySupported("fallocate", Fallocate, "Not all options are supported.", nil) - s.Table[286] = syscalls.Supported("timerfd_settime", TimerfdSettime) - s.Table[287] = syscalls.Supported("timerfd_gettime", TimerfdGettime) + s.Table[286] = syscalls.SupportedPoint("timerfd_settime", TimerfdSettime, linux.PointTimerfdSettime) + s.Table[287] = syscalls.SupportedPoint("timerfd_gettime", TimerfdGettime, linux.PointTimerfdGettime) s.Table[288] = syscalls.SupportedPoint("accept4", Accept4, linux.PointAccept4) s.Table[289] = syscalls.SupportedPoint("signalfd4", Signalfd4, linux.PointSignalfd4) s.Table[290] = syscalls.SupportedPoint("eventfd2", Eventfd2, linux.PointEventfd2) s.Table[291] = syscalls.Supported("epoll_create1", EpollCreate1) s.Table[292] = syscalls.SupportedPoint("dup3", Dup3, linux.PointDup3) s.Table[293] = syscalls.SupportedPoint("pipe2", Pipe2, linux.PointPipe2) - s.Table[294] = syscalls.PartiallySupported("inotify_init1", InotifyInit1, "inotify events are only available inside the sandbox.", nil) + s.Table[294] = syscalls.PartiallySupportedPoint("inotify_init1", InotifyInit1, linux.PointInotifyInit1, "inotify events are only available inside the sandbox.", nil) s.Table[295] = syscalls.Supported("preadv", Preadv) s.Table[296] = syscalls.Supported("pwritev", Pwritev) s.Table[299] = syscalls.Supported("recvmmsg", RecvMMsg) @@ -190,9 +190,9 @@ func Override() { s.Table[23] = syscalls.SupportedPoint("dup", Dup, linux.PointDup) s.Table[24] = syscalls.SupportedPoint("dup3", Dup3, linux.PointDup3) s.Table[25] = syscalls.SupportedPoint("fcntl", Fcntl, linux.PointFcntl) - s.Table[26] = syscalls.PartiallySupported("inotify_init1", InotifyInit1, "inotify events are only available inside the sandbox.", nil) - s.Table[27] = syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "inotify events are only available inside the sandbox.", nil) - s.Table[28] = syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "inotify events are only available inside the sandbox.", nil) + s.Table[26] = syscalls.PartiallySupportedPoint("inotify_init1", InotifyInit1, linux.PointInotifyInit1, "inotify events are only available inside the sandbox.", nil) + s.Table[27] = syscalls.PartiallySupportedPoint("inotify_add_watch", InotifyAddWatch, linux.PointInotifyAddWatch, "inotify events are only available inside the sandbox.", nil) + s.Table[28] = syscalls.PartiallySupportedPoint("inotify_rm_watch", InotifyRmWatch, linux.PointInotifyRmWatch, "inotify events are only available inside the sandbox.", nil) s.Table[29] = syscalls.Supported("ioctl", Ioctl) s.Table[32] = syscalls.Supported("flock", Flock) s.Table[33] = syscalls.Supported("mknodat", Mknodat) @@ -243,14 +243,14 @@ func Override() { s.Table[82] = syscalls.Supported("fsync", Fsync) s.Table[83] = syscalls.Supported("fdatasync", Fdatasync) s.Table[84] = syscalls.Supported("sync_file_range", SyncFileRange) - s.Table[85] = syscalls.Supported("timerfd_create", TimerfdCreate) - s.Table[86] = syscalls.Supported("timerfd_settime", TimerfdSettime) - s.Table[87] = syscalls.Supported("timerfd_gettime", TimerfdGettime) + s.Table[85] = syscalls.SupportedPoint("timerfd_create", TimerfdCreate, linux.PointTimerfdCreate) + s.Table[86] = syscalls.SupportedPoint("timerfd_settime", TimerfdSettime, linux.PointTimerfdSettime) + s.Table[87] = syscalls.SupportedPoint("timerfd_gettime", TimerfdGettime, linux.PointTimerfdGettime) s.Table[88] = syscalls.Supported("utimensat", Utimensat) s.Table[180] = syscalls.Supported("mq_open", MqOpen) s.Table[181] = syscalls.Supported("mq_unlink", MqUnlink) s.Table[198] = syscalls.SupportedPoint("socket", Socket, linux.PointSocket) - s.Table[199] = syscalls.Supported("socketpair", SocketPair) + s.Table[199] = syscalls.SupportedPoint("socketpair", SocketPair, linux.PointSocketpair) s.Table[200] = syscalls.SupportedPoint("bind", Bind, linux.PointBind) s.Table[201] = syscalls.Supported("listen", Listen) s.Table[202] = syscalls.SupportedPoint("accept", Accept, linux.PointAccept)