seccomp: patchbpf: always include native architecture in stub #4219
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
We'Ve confirmed this fixes the issue on ppc64le. For background, this issue means that our ENOSYS stub has never worked on ppc64le with Docker's default profile 😰. |
AkihiroSuda
reviewed
Mar 27, 2024
AkihiroSuda
approved these changes
Mar 27, 2024
cyphar
force-pushed
the
seccomp-patchbpf-ppc64le
branch
from
376417b
to
4f4f093
Compare
Calling the Linux AUDIT_* architecture constants "native" leads to confusing code when we are getting the actual native architecture of the running system. Signed-off-by: Aleksa Sarai <[email protected]>
It turns out that on ppc64le (at least), Docker doesn't include any architectures in the list of allowed architectures. libseccomp interprets this as "just include the default architecture" but patchbpf would return a no-op ENOSYS stub, which would lead to the exact issues that commit 7a8d716 ("seccomp: prepend -ENOSYS stub to all filters") fixed for other architectures. So, just always include the running architecture in the list. There's no real downside. Ref: https://bugzilla.suse.com/show_bug.cgi?id=1192051#c6 Reported-by: Fabian Vogt <[email protected]> Signed-off-by: Aleksa Sarai <[email protected]>
cyphar
force-pushed
the
seccomp-patchbpf-ppc64le
branch
from
4f4f093
to
ccc500c
Compare
Merged
lifubang
added
the
backport/1.1-done
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It turns out that on ppc64le (at least), Docker doesn't include any
architectures in the list of allowed architectures. libseccomp
interprets this as "just include the default architecture" but patchbpf
would return a no-op ENOSYS stub, which would lead to the exact issues
that commit 7a8d716 ("seccomp: prepend -ENOSYS stub to all
filters") fixed for other architectures.
So, just always include the running architecture in the list. There's
no real downside.
Ref: https://bugzilla.suse.com/show_bug.cgi?id=1192051#c6
Reported-by: Fabian Vogt [email protected]
Signed-off-by: Aleksa Sarai [email protected]