netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Force clone parent_tidptr and child_tidptr to zero

Browse Source 
Neither CLONE_PARENT_SETTID nor CLONE_CHILD_SETTID are used, so these arguments
will always be NULL.

PiperOrigin-RevId: 333085326
This commit is contained in:
Michael Pratt
2020-09-22 08:41:07 -07:00
committed by gVisor bot
parent 742e58b873
commit f134f873fc
6 changed files with 91 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/boot/filter/config.go
+2 -13
View File
@@ -27,19 +27,8 @@ import (
// allowedSyscalls is the set of syscalls executed by the Sentry to the host OS.
var allowedSyscalls = seccomp.SyscallRules{
syscall.SYS_CLOCK_GETTIME: {},
syscall.SYS_CLONE: []seccomp.Rule{
{
seccomp.EqualTo(
syscall.CLONE_VM |
syscall.CLONE_FS |
syscall.CLONE_FILES |
syscall.CLONE_SIGHAND |
syscall.CLONE_SYSVSEM |
syscall.CLONE_THREAD),
},
},
syscall.SYS_CLOSE: {},
syscall.SYS_DUP: {},
syscall.SYS_CLOSE: {},
syscall.SYS_DUP: {},
syscall.SYS_DUP3: []seccomp.Rule{
{
seccomp.MatchAny{},
runsc/boot/filter/config_amd64.go
+21 -3
View File
@@ -24,7 +24,25 @@ import (
)
func init() {
allowedSyscalls[syscall.SYS_ARCH_PRCTL] = append(allowedSyscalls[syscall.SYS_ARCH_PRCTL],
seccomp.Rule{seccomp.EqualTo(linux.ARCH_SET_FS)},
)
allowedSyscalls[syscall.SYS_ARCH_PRCTL] = []seccomp.Rule{
{seccomp.EqualTo(linux.ARCH_SET_FS)},
}
allowedSyscalls[syscall.SYS_CLONE] = []seccomp.Rule{
// parent_tidptr and child_tidptr are always 0 because neither
// CLONE_PARENT_SETTID nor CLONE_CHILD_SETTID are used.
{
seccomp.EqualTo(
syscall.CLONE_VM |
syscall.CLONE_FS |
syscall.CLONE_FILES |
syscall.CLONE_SIGHAND |
syscall.CLONE_SYSVSEM |
syscall.CLONE_THREAD),
seccomp.MatchAny{}, // newsp
seccomp.EqualTo(0), // parent_tidptr
seccomp.EqualTo(0), // child_tidptr
seccomp.MatchAny{}, // tls
},
}
}
runsc/boot/filter/config_arm64.go
+26 -1
View File
@@ -16,6 +16,31 @@
package filter
// Reserve for future customization.
import (
"syscall"
"gvisor.dev/gvisor/pkg/seccomp"
)
func init() {
allowedSyscalls[syscall.SYS_CLONE] = []seccomp.Rule{
// parent_tidptr and child_tidptr are always 0 because neither
// CLONE_PARENT_SETTID nor CLONE_CHILD_SETTID are used.
{
seccomp.EqualTo(
syscall.CLONE_VM |
syscall.CLONE_FS |
syscall.CLONE_FILES |
syscall.CLONE_SIGHAND |
syscall.CLONE_SYSVSEM |
syscall.CLONE_THREAD),
seccomp.MatchAny{}, // newsp
// These arguments are left uninitialized by the Go
// runtime, so they may be anything (and are unused by
// the host).
seccomp.MatchAny{}, // parent_tidptr
seccomp.MatchAny{}, // tls
seccomp.MatchAny{}, // child_tidptr
},
}
}
runsc/fsgofer/filter/config.go
+3 -14
View File
@@ -27,20 +27,9 @@ import (
var allowedSyscalls = seccomp.SyscallRules{
syscall.SYS_ACCEPT: {},
syscall.SYS_CLOCK_GETTIME: {},
syscall.SYS_CLONE: []seccomp.Rule{
{
seccomp.EqualTo(
syscall.CLONE_VM |
syscall.CLONE_FS |
syscall.CLONE_FILES |
syscall.CLONE_SIGHAND |
syscall.CLONE_SYSVSEM |
syscall.CLONE_THREAD),
},
},
syscall.SYS_CLOSE: {},
syscall.SYS_DUP: {},
syscall.SYS_EPOLL_CTL: {},
syscall.SYS_CLOSE: {},
syscall.SYS_DUP: {},
syscall.SYS_EPOLL_CTL: {},
syscall.SYS_EPOLL_PWAIT: []seccomp.Rule{
{
seccomp.MatchAny{},
runsc/fsgofer/filter/config_amd64.go
+18
View File
@@ -28,5 +28,23 @@ func init() {
{seccomp.EqualTo(linux.ARCH_SET_FS)},
}
allowedSyscalls[syscall.SYS_CLONE] = []seccomp.Rule{
// parent_tidptr and child_tidptr are always 0 because neither
// CLONE_PARENT_SETTID nor CLONE_CHILD_SETTID are used.
{
seccomp.EqualTo(
syscall.CLONE_VM |
syscall.CLONE_FS |
syscall.CLONE_FILES |
syscall.CLONE_SIGHAND |
syscall.CLONE_SYSVSEM |
syscall.CLONE_THREAD),
seccomp.MatchAny{}, // newsp
seccomp.EqualTo(0), // parent_tidptr
seccomp.EqualTo(0), // child_tidptr
seccomp.MatchAny{}, // tls
},
}
allowedSyscalls[syscall.SYS_NEWFSTATAT] = []seccomp.Rule{}
}
runsc/fsgofer/filter/config_arm64.go
+21
View File
@@ -23,5 +23,26 @@ import (
)
func init() {
allowedSyscalls[syscall.SYS_CLONE] = []seccomp.Rule{
// parent_tidptr and child_tidptr are always 0 because neither
// CLONE_PARENT_SETTID nor CLONE_CHILD_SETTID are used.
{
seccomp.EqualTo(
syscall.CLONE_VM |
syscall.CLONE_FS |
syscall.CLONE_FILES |
syscall.CLONE_SIGHAND |
syscall.CLONE_SYSVSEM |
syscall.CLONE_THREAD),
seccomp.MatchAny{}, // newsp
// These arguments are left uninitialized by the Go
// runtime, so they may be anything (and are unused by
// the host).
seccomp.MatchAny{}, // parent_tidptr
seccomp.MatchAny{}, // tls
seccomp.MatchAny{}, // child_tidptr
},
}
allowedSyscalls[syscall.SYS_FSTATAT] = []seccomp.Rule{}
}