Attachment 3615 Details for Bug 3478 – Change seccomp sandbox default action to ENOSYS

[patch] Change seccomp sandbox default action to ENOSYS

0001-Change-seccomp-sandbox-default-action-to-ENOSYS.patch (text/plain), 1.80 KB, created by Colin Watson on 2022-10-02 05:54:27 AEDT

(hide)

Description:

Filename:

MIME Type:

Creator: Colin Watson

Created: 2022-10-02 05:54:27 AEDT

Size: 1.80 KB

patch

obsolete

>From c81988551189832ac6ce63f2cf1302762d462172 Mon Sep 17 00:00:00 2001
>From: Colin Watson <cjwatson@debian.org>
>Date: Sat, 1 Oct 2022 18:51:23 +0100
>Subject: [PATCH] Change seccomp sandbox default action to ENOSYS
>
>This makes sshd less fragile across changes of kernel/libc versions,
>allowing libc to fall back to different syscalls.  Denied syscalls are
>still not executed, so this shouldn't cause any increased attack
>surface.
>
>A sandboxed process could potentially get confused by syscalls
>unexpectedly returning ENOSYS, although this shouldn't happen in normal
>circumstances if the filter is correct, and confusing a compromised
>process doesn't particularly matter.
>---
> sandbox-seccomp-filter.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
>diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
>index 9929bdb68..1af95f506 100644
>--- a/sandbox-seccomp-filter.c
>+++ b/sandbox-seccomp-filter.c
>@@ -95,6 +95,9 @@
> #define SC_DENY(_nr, _errno) \
> 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 1), \
> 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO|(_errno))
>+#define SC_FAIL(_nr) \
>+	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 1), \
>+	BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL)
> #define SC_ALLOW(_nr) \
> 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 1), \
> 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
>@@ -334,8 +337,15 @@ static const struct sock_filter preauth_insns[] = {
> 	SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT),
> #endif
> 
>+	/*
>+	 * umask never returns an error, so explicitly kill the process if
>+	 * it tries to use that.  See
>+	 * https://bugzilla.mozilla.org/show_bug.cgi?id=1724098.
>+	 */
>+	SC_FAIL(__NR_umask),
>+
> 	/* Default deny */
>-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
>+	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO|ENOSYS),
> };
> 
> static const struct sock_fprog preauth_program = {
>-- 
>2.37.2
>

Actions: View | Diff

Attachments on bug 3478: 3615 | 3640 | 3641