Messages in this thread | | | Date | Tue, 15 Sep 2015 10:07:38 -0600 | From | Tycho Andersen <> | Subject | Re: v2 of seccomp filter c/r patches |
| |
Hi Andy,
On Mon, Sep 14, 2015 at 10:52:46AM -0700, Andy Lutomirski wrote: > > I'm not sure I entirely like this solution...
Ok. Since we also aren't going to do all the eBPF stuff now, how about something that looks like this:
struct seccomp_layer { unsigned int size; unsigned int type; /* SECCOMP_BPF_CLASSIC or SECCOMP_EBPF or ... */ bool inherited; union { unsigned int insn_cnt; struct bpf_insn *insns; }; };
with a ptrace command:
ptrace(PTRACE_SECCOMP_DUMP_LAYER, pid, i, &layer);
If we save a pointer to the current seccomp filter on fork (if there is one), then I think the inherited flag is just,
inherited = is_ancestor(child->seccomp.filter, child->seccomp.inherited_filter)
In order to restore this (so it can be checkpointed again), we need a command that looks like:
seccomp(SECCOMP_INHERIT_FILTER);
which sets the current and inherited filter to that of the parent process. (Optionally we could have seccomp(SECCOMP_INHERIT_FILTER, i) to inherit the ith filter from the parent, but we can coordinate this via userpace so it's not strictly necessary.) So the whole c/r process looks something like:
--- dump ---
for (i = 0; true; i++) { ret = ptrace(PTRACE_SECCOMP_DUMP_FILTER, pid, i, &layer); if (ret == -ESRCH) break; if (ret < 0) /* real error */
/* save the filter if it's not inherited, if it is, mark the filter * to be inherited from ppid; note that this index is walking up the * tree following filter->prev, and the index we want to reason * about on restore is walking down, so we should reverse the whole * array. */ }
--- restore ---
if (have_inherited_filters) { wait_for_ppid_seccomp_restore(n_inherited); seccomp(SECCOMP_INHERIT_FILTER); signal_done_inheriting(); }
for (i = 0; i < n_filters; i++) { seccomp(SECCOMP_SET_MODE_FILTER, ...); if (child_inherited_filter(i)) signal_children_filter(i); }
I played around with an implementation of SECCOMP_INHERIT_FILTER last night and I think I have one that might work. Thoughts?
Tycho
| |