Skip to content

L
lxc
Unverified Commit 7e84441e by Christian Brauner
Options

seccomp: non-functional changes

Rename "compat_ctx" to "contexts" and "compat_arch" to "architectures". Signed-off-by: 's avatarChristian Brauner <christian.brauner@ubuntu.com>
parent 4160ef02
Showing with 59 additions and 55 deletions
src/lxc/seccomp.c
...@@ -490,12 +490,12 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf) ...@@ -490,12 +490,12 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
{ {
char *p; char *p;
int ret; int ret;
scmp_filter_ctx compat_ctx[2] = {NULL, NULL}; scmp_filter_ctx contexts[3] = {NULL, NULL};
bool blacklist = false; bool blacklist = false;
uint32_t default_policy_action = -1, default_rule_action = -1; uint32_t default_policy_action = -1, default_rule_action = -1;
enum lxc_hostarch_t native_arch = get_hostarch(), enum lxc_hostarch_t native_arch = get_hostarch(),
cur_rule_arch = native_arch; cur_rule_arch = native_arch;
uint32_t compat_arch[2] = {SCMP_ARCH_NATIVE, SCMP_ARCH_NATIVE}; uint32_t architectures[2] = {SCMP_ARCH_NATIVE, SCMP_ARCH_NATIVE};
struct seccomp_v2_rule rule; struct seccomp_v2_rule rule;
if (strncmp(line, "blacklist", 9) == 0) if (strncmp(line, "blacklist", 9) == 0)
...@@ -526,52 +526,52 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf) ...@@ -526,52 +526,52 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
if (native_arch == lxc_seccomp_arch_amd64) { if (native_arch == lxc_seccomp_arch_amd64) {
cur_rule_arch = lxc_seccomp_arch_all; cur_rule_arch = lxc_seccomp_arch_all;
compat_arch[0] = SCMP_ARCH_X86; architectures[0] = SCMP_ARCH_X86;
compat_ctx[0] = get_new_ctx(lxc_seccomp_arch_i386, contexts[0] = get_new_ctx(lxc_seccomp_arch_i386,
default_policy_action); default_policy_action);
compat_arch[1] = SCMP_ARCH_X32; architectures[1] = SCMP_ARCH_X32;
compat_ctx[1] = get_new_ctx(lxc_seccomp_arch_x32, contexts[1] = get_new_ctx(lxc_seccomp_arch_x32,
default_policy_action); default_policy_action);
if (!compat_ctx[0] || !compat_ctx[1]) if (!contexts[0] || !contexts[1])
goto bad; goto bad;
#ifdef SCMP_ARCH_PPC #ifdef SCMP_ARCH_PPC
} else if (native_arch == lxc_seccomp_arch_ppc64) { } else if (native_arch == lxc_seccomp_arch_ppc64) {
cur_rule_arch = lxc_seccomp_arch_all; cur_rule_arch = lxc_seccomp_arch_all;
compat_arch[0] = SCMP_ARCH_PPC; architectures[0] = SCMP_ARCH_PPC;
compat_ctx[0] = get_new_ctx(lxc_seccomp_arch_ppc, contexts[0] = get_new_ctx(lxc_seccomp_arch_ppc,
default_policy_action); default_policy_action);
if (!compat_ctx[0]) if (!contexts[0])
goto bad; goto bad;
#endif #endif
#ifdef SCMP_ARCH_ARM #ifdef SCMP_ARCH_ARM
} else if (native_arch == lxc_seccomp_arch_arm64) { } else if (native_arch == lxc_seccomp_arch_arm64) {
cur_rule_arch = lxc_seccomp_arch_all; cur_rule_arch = lxc_seccomp_arch_all;
compat_arch[0] = SCMP_ARCH_ARM; architectures[0] = SCMP_ARCH_ARM;
compat_ctx[0] = get_new_ctx(lxc_seccomp_arch_arm, contexts[0] = get_new_ctx(lxc_seccomp_arch_arm,
default_policy_action); default_policy_action);
if (!compat_ctx[0]) if (!contexts[0])
goto bad; goto bad;
#endif #endif
#ifdef SCMP_ARCH_MIPS #ifdef SCMP_ARCH_MIPS
} else if (native_arch == lxc_seccomp_arch_mips64) { } else if (native_arch == lxc_seccomp_arch_mips64) {
cur_rule_arch = lxc_seccomp_arch_all; cur_rule_arch = lxc_seccomp_arch_all;
compat_arch[0] = SCMP_ARCH_MIPS; architectures[0] = SCMP_ARCH_MIPS;
compat_arch[1] = SCMP_ARCH_MIPS64N32; architectures[1] = SCMP_ARCH_MIPS64N32;
compat_ctx[0] = get_new_ctx(lxc_seccomp_arch_mips, contexts[0] = get_new_ctx(lxc_seccomp_arch_mips,
default_policy_action); default_policy_action);
compat_ctx[1] = get_new_ctx(lxc_seccomp_arch_mips64n32, contexts[1] = get_new_ctx(lxc_seccomp_arch_mips64n32,
default_policy_action); default_policy_action);
if (!compat_ctx[0] || !compat_ctx[1]) if (!contexts[0] || !contexts[1])
goto bad; goto bad;
} else if (native_arch == lxc_seccomp_arch_mipsel64) { } else if (native_arch == lxc_seccomp_arch_mipsel64) {
cur_rule_arch = lxc_seccomp_arch_all; cur_rule_arch = lxc_seccomp_arch_all;
compat_arch[0] = SCMP_ARCH_MIPSEL; architectures[0] = SCMP_ARCH_MIPSEL;
compat_arch[1] = SCMP_ARCH_MIPSEL64N32; architectures[1] = SCMP_ARCH_MIPSEL64N32;
compat_ctx[0] = get_new_ctx(lxc_seccomp_arch_mipsel, contexts[0] = get_new_ctx(lxc_seccomp_arch_mipsel,
default_policy_action); default_policy_action);
compat_ctx[1] = get_new_ctx(lxc_seccomp_arch_mipsel64n32, contexts[1] = get_new_ctx(lxc_seccomp_arch_mipsel64n32,
default_policy_action); default_policy_action);
if (!compat_ctx[0] || !compat_ctx[1]) if (!contexts[0] || !contexts[1])
goto bad; goto bad;
#endif #endif
} }
...@@ -758,8 +758,9 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf) ...@@ -758,8 +758,9 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
if (cur_rule_arch == native_arch || if (cur_rule_arch == native_arch ||
cur_rule_arch == lxc_seccomp_arch_native || cur_rule_arch == lxc_seccomp_arch_native ||
compat_arch[0] == SCMP_ARCH_NATIVE) { architectures[0] == SCMP_ARCH_NATIVE) {
if (!do_resolve_add_rule(SCMP_ARCH_NATIVE, line, conf->seccomp_ctx, &rule)) if (!do_resolve_add_rule(SCMP_ARCH_NATIVE, line,
conf->seccomp_ctx, &rule))
goto bad_rule; goto bad_rule;
INFO("Added native rule for arch %d for %s action %d(%s)", INFO("Added native rule for arch %d for %s action %d(%s)",
SCMP_ARCH_NATIVE, line, rule.action, SCMP_ARCH_NATIVE, line, rule.action,
...@@ -771,41 +772,45 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf) ...@@ -771,41 +772,45 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
(cur_rule_arch == lxc_seccomp_arch_mipsel64n32)) (cur_rule_arch == lxc_seccomp_arch_mipsel64n32))
arch_index = 1; arch_index = 1;
if (!do_resolve_add_rule(compat_arch[arch_index], line, compat_ctx[arch_index], &rule)) if (!do_resolve_add_rule(architectures[arch_index], line,
contexts[arch_index], &rule))
goto bad_rule; goto bad_rule;
INFO("Added compat-only rule for arch %d for %s action %d(%s)", INFO("Added compat-only rule for arch %d for %s action %d(%s)",
compat_arch[arch_index], line, rule.action, architectures[arch_index], line, rule.action,
get_action_name(rule.action)); get_action_name(rule.action));
} else { } else {
if (!do_resolve_add_rule(SCMP_ARCH_NATIVE, line, conf->seccomp_ctx, &rule)) if (!do_resolve_add_rule(SCMP_ARCH_NATIVE, line,
conf->seccomp_ctx, &rule))
goto bad_rule; goto bad_rule;
INFO("Added native rule for arch %d for %s action %d(%s)", INFO("Added native rule for arch %d for %s action %d(%s)",
SCMP_ARCH_NATIVE, line, rule.action, SCMP_ARCH_NATIVE, line, rule.action,
get_action_name(rule.action)); get_action_name(rule.action));
if (compat_arch[0] != SCMP_ARCH_NATIVE) { if (architectures[0] != SCMP_ARCH_NATIVE) {
if (!do_resolve_add_rule(compat_arch[0], line, compat_ctx[0], &rule)) if (!do_resolve_add_rule(architectures[0], line,
contexts[0], &rule))
goto bad_rule; goto bad_rule;
INFO("Added compat rule for arch %d for %s " INFO("Added compat rule for arch %d for %s action %d(%s)",
"action %d(%s)", compat_arch[0], line, architectures[0], line, rule.action,
rule.action, get_action_name(rule.action)); get_action_name(rule.action));
} }
if (compat_arch[1] != SCMP_ARCH_NATIVE) { if (architectures[1] != SCMP_ARCH_NATIVE) {
if (!do_resolve_add_rule(compat_arch[1], line, compat_ctx[1], &rule)) if (!do_resolve_add_rule(architectures[1], line,
contexts[1], &rule))
goto bad_rule; goto bad_rule;
INFO("Added compat rule for arch %d for %s " INFO("Added compat rule for arch %d for %s action %d(%s)",
"action %d(%s)", compat_arch[1], line, architectures[1], line, rule.action,
rule.action, get_action_name(rule.action)); get_action_name(rule.action));
} }
} }
} }
INFO("Merging compat seccomp contexts into main context"); INFO("Merging compat seccomp contexts into main context");
if (compat_ctx[0]) { if (contexts[0]) {
if ((compat_arch[0] != native_arch) && if ((architectures[0] != native_arch) &&
(compat_arch[0] != seccomp_arch_native())) { (architectures[0] != seccomp_arch_native())) {
ret = seccomp_merge(conf->seccomp_ctx, compat_ctx[0]); ret = seccomp_merge(conf->seccomp_ctx, contexts[0]);
if (ret < 0) { if (ret < 0) {
ERROR("Failed to merge first compat seccomp " ERROR("Failed to merge first compat seccomp "
"context into main context"); "context into main context");
...@@ -813,15 +818,15 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf) ...@@ -813,15 +818,15 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
} }
TRACE("Merged first compat seccomp context into main context"); TRACE("Merged first compat seccomp context into main context");
} else { } else {
seccomp_release(compat_ctx[0]); seccomp_release(contexts[0]);
compat_ctx[0] = NULL; contexts[0] = NULL;
} }
} }
if (compat_ctx[1]) { if (contexts[1]) {
if ((compat_arch[1] != native_arch) && if ((architectures[1] != native_arch) &&
(compat_arch[1] != seccomp_arch_native())) { (architectures[1] != seccomp_arch_native())) {
ret = seccomp_merge(conf->seccomp_ctx, compat_ctx[1]); ret = seccomp_merge(conf->seccomp_ctx, contexts[1]);
if (ret < 0) { if (ret < 0) {
ERROR("Failed to merge first compat seccomp " ERROR("Failed to merge first compat seccomp "
"context into main context"); "context into main context");
...@@ -829,8 +834,8 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf) ...@@ -829,8 +834,8 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
} }
TRACE("Merged second compat seccomp context into main context"); TRACE("Merged second compat seccomp context into main context");
} else { } else {
seccomp_release(compat_ctx[1]); seccomp_release(contexts[1]);
compat_ctx[1] = NULL; contexts[1] = NULL;
} }
} }
...@@ -840,10 +845,10 @@ bad_arch: ...@@ -840,10 +845,10 @@ bad_arch:
ERROR("Unsupported arch: %s.", line); ERROR("Unsupported arch: %s.", line);
bad_rule: bad_rule:
bad: bad:
if (compat_ctx[0]) if (contexts[0])
seccomp_release(compat_ctx[0]); seccomp_release(contexts[0]);
if (compat_ctx[1]) if (contexts[1])
seccomp_release(compat_ctx[1]); seccomp_release(contexts[1]);
return -1; return -1;
} }
#else /* HAVE_DECL_SECCOMP_SYSCALL_RESOLVE_NAME_ARCH */ #else /* HAVE_DECL_SECCOMP_SYSCALL_RESOLVE_NAME_ARCH */
......
src/tests/api_reboot.c
...@@ -59,7 +59,6 @@ int main(int argc, char *argv[]) ...@@ -59,7 +59,6 @@ int main(int argc, char *argv[])
lxc_error("%s\n", "Container \"reboot\" is not defined"); lxc_error("%s\n", "Container \"reboot\" is not defined");
goto on_error_put; goto on_error_put;
} }
c->clear_config(c); c->clear_config(c);
if (!c->load_config(c, NULL)) { if (!c->load_config(c, NULL)) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment