seccomp: support 'all' arch sections (plus bugfixes)

seccomp_ctx is already a void*, so don't use 'scmp_filter_ctx *' Separately track the native arch from the arch a rule is aimed at. Clearly ignore irrelevant architectures (i.e. arm rules on x86) Don't try to load seccomp (and don't fail) if we are already seccomp-confined. Otherwise nested containers fail. Make it clear that the extra seccomp ctx is only for compat calls on 64-bit arch. (This will be extended to arm64 when libseccomp supports it). Power may will complicate this (if ever it is supported) and require a new rethink and rewrite. NOTE - currently when starting a 32-bit container on 64-bit host, rules pertaining to 32-bit syscalls (as opposed to once which have the same syscall #) appear to be ignored. I can reproduce that without lxc, so either there is a bug in seccomp or a fundamental misunderstanding in how I"m merging the contexts. Rereading the seccomp_rule_add manpage suggests that keeping the seccond seccomp context may not be necessary, but this is not something I care to test right now. If it's true, then the code could be simplified, and it may solve my concerns about power. With this patch I'm able to start nested containers (with seccomp policies defined) including 32-bit and 32-bit-in-64-bit. [ this patch does not yet add the default seccomp policy ] Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

seccomp: support 'all' arch sections (plus bugfixes)
391ece78 · Serge Hallyn · Stéphane Graber · 87850eca · 391ece78 · 391ece78
Commit 391ece78 authored Jun 19, 2014 by Serge Hallyn Committed by Stéphane Graber Jun 30, 2014
Expand all Hide whitespace changes
Inline Side-by-side

Showing with 234 additions and 55 deletions

conf.h src/lxc/conf.h +1 -1

seccomp.c src/lxc/seccomp.c +233 -54

No files found.
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -311,7 +311,7 @@ struct lxc_conf {
 	int tmp_umount_proc;
 	char *seccomp;  // filename with the seccomp rules
 #if HAVE_SCMP_FILTER_CTX
-	scmp_filter_ctx *seccomp_ctx;
+	scmp_filter_ctx seccomp_ctx;
 #endif
 	int maincmd_fd;
 	int autodev;  // if 1, mount and fill a /dev at start

--- a/src/lxc/seccomp.c
+++ b/src/lxc/seccomp.c