From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stefano Brivio To: passt-dev@passt.top Subject: [PATCH] passt: Allow exit_group() system call in seccomp profiles Date: Wed, 13 Jul 2022 08:17:47 +0200 Message-ID: <20220713061747.1427736-1-sbrivio@redhat.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4381557765741831107==" --===============4381557765741831107== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable We handle SIGQUIT and SIGTERM calling exit(), which is usually implemented with the exit_group() system call. If we don't allow exit_group(), we'll get a SIGSYS while handling SIGQUIT and SIGTERM, which means a misleading non-zero exit code. Reported-by: Wenli Quan Link: https://bugzilla.redhat.com/show_bug.cgi?id=3D2101990 Signed-off-by: Stefano Brivio --- Makefile | 2 +- README.md | 2 +- passt.c | 2 ++ 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 0077fc9..6f7c971 100644 --- a/Makefile +++ b/Makefile @@ -115,7 +115,7 @@ qrap: $(QRAP_SRCS) passt.h =20 valgrind: EXTRA_SYSCALLS=3D"rt_sigprocmask rt_sigtimedwait rt_sigaction \ getpid gettid kill clock_gettime mmap munmap open \ - unlink exit_group gettimeofday" + unlink gettimeofday" valgrind: CFLAGS:=3D-g -O0 $(filter-out -O%,$(CFLAGS)) valgrind: all =20 diff --git a/README.md b/README.md index 4fed6d5..628b9bb 100644 --- a/README.md +++ b/README.md @@ -286,7 +286,7 @@ speeding up local connections, and usually requiring NAT.= _pasta_: * =E2=9C=85 all capabilities dropped, other than `CAP_NET_BIND_SERVICE` (if = granted) * =E2=9C=85 with default options, user, mount, IPC, UTS, PID namespaces are = detached * =E2=9C=85 no external dependencies (other than a standard C library) -* =E2=9C=85 restrictive seccomp profiles (25 syscalls allowed for _passt_, 3= 9 for +* =E2=9C=85 restrictive seccomp profiles (26 syscalls allowed for _passt_, 4= 0 for _pasta_ on x86_64) * =E2=9C=85 examples of [AppArmor](/passt/tree/contrib/apparmor) and [SELinux](/passt/tree/contrib/selinux) profiles available diff --git a/passt.c b/passt.c index 56fcf5f..a8d94b4 100644 --- a/passt.c +++ b/passt.c @@ -257,6 +257,8 @@ static int sandbox(struct ctx *c) * * TODO: After unsharing the PID namespace and forking, SIG_DFL for SIGTERM = and * SIGQUIT unexpectedly doesn't cause the process to terminate, figure out w= hy. + * + * #syscalls exit_group */ void exit_handler(int signal) { --=20 2.35.1 --===============4381557765741831107==--