ukui/apt
0
0
Fork 0
mirror of https://github.com/ukui/apt.git synced 2026-03-09 09:35:45 -07:00
Code Issues Packages Projects Releases Wiki Activity

Print syscall number and arch to stderr when trapped by seccomp

Browse Source 
This should help debugging crashes. The signal handler is a C++11
lambda, yay! Special care has been taken to only use signal handler
-safe functions inside there.
This commit is contained in:
Julian Andres Klode
2017-10-25 23:16:09 +02:00
parent 230b057053
commit 39656a6f79
2 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
doc/examples/configure-index
View File

@@ -640,6 +640,7 @@ apt::system "<STRING>";
apt::acquire::translation "<STRING>"; // deprecated in favor of Acquire::Languages
apt::sandbox::user "<STRING>";
apt::sandbox::seccomp "<BOOL>";
apt::sandbox::seccomp::print "<BOOL>"; // print what syscall was trapped
apt::sandbox::seccomp::allow "<LIST>";
apt::sandbox::seccomp::trap "<LIST>";
apt::color::highlight "<STRING>";

33
methods/aptmethod.h
View File

@@ -22,6 +22,8 @@
#include <apti18n.h>
#ifdef HAVE_SECCOMP
#include <signal.h>
#include <seccomp.h>
#endif
@@ -268,6 +270,37 @@ protected:
Warning("aptMethod::Configuration: could not load seccomp policy: %s", strerror(-rc));
else if (rc != 0)
return _error->FatalE("aptMethod::Configuration", "could not load seccomp policy: %s", strerror(-rc));
if (_config->FindB("APT::Sandbox::Seccomp::Print", true))
{
struct sigaction action;
memset(&action, 0, sizeof(action));
sigemptyset(&action.sa_mask);
action.sa_sigaction = [](int, siginfo_t *info, void *) {
// Formats a number into a 10 digit ASCII string
char buffer[10];
int number = info->si_syscall;
for (int i = sizeof(buffer) - 1; i >= 0; i--)
{
buffer[i] = (number % 10) + '0';
number /= 10;
}
constexpr const char *str1 = "\n **** Seccomp prevented execution of syscall ";
constexpr const char *str2 = " on architecture ";
constexpr const char *str3 = " ****\n";
write(2, str1, strlen(str1));
write(2, buffer, sizeof(buffer));
write(2, str2, strlen(str2));
write(2, COMMON_ARCH, strlen(COMMON_ARCH));
write(2, str3, strlen(str3));
_exit(31);
};
action.sa_flags = SA_SIGINFO;
sigaction(SIGSYS, &action, nullptr);
}
#endif
return true;
}