Skip to content

Commit

Permalink
Merge bitcoin#23255: util: Add mincore and clone3 to syscall sandbox
Browse files Browse the repository at this point in the history
fab4073 util: Add mincore and clone3 to syscall sandbox (MarcoFalke)

Pull request description:

  Closes bitcoin#23248

ACKs for top commit:
  practicalswift:
    cr ACK fab4073
  laanwj:
    ACK fab4073
  fanquake:
    ACK fab4073

Tree-SHA512: a8eb6b1844e40880163d2c52022dc4f84a53fae4d82fc651e456f527eca455dec32bbf960dac4366915c8a73d57b546b0b18f11b4da031962f7f775f2ca8c112
  • Loading branch information
fanquake committed Oct 12, 2021
2 parents 1790a8d + fab4073 commit e418a8e
Showing 1 changed file with 9 additions and 0 deletions.
9 changes: 9 additions & 0 deletions src/util/syscall_sandbox.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,12 @@ bool g_syscall_sandbox_log_violation_before_terminating{false};

// Define system call numbers for x86_64 that are referenced in the system call profile
// but not provided by the kernel headers used in the GUIX build.
// Usually, they can be found via "grep name /usr/include/x86_64-linux-gnu/asm/unistd_64.h"

#ifndef __NR_clone3
#define __NR_clone3 435
#endif

#ifndef __NR_statx
#define __NR_statx 332
#endif
Expand Down Expand Up @@ -115,6 +121,7 @@ const std::map<uint32_t, std::string> LINUX_SYSCALLS{
{__NR_clock_nanosleep, "clock_nanosleep"},
{__NR_clock_settime, "clock_settime"},
{__NR_clone, "clone"},
{__NR_clone3, "clone3"},
{__NR_close, "close"},
{__NR_connect, "connect"},
{__NR_copy_file_range, "copy_file_range"},
Expand Down Expand Up @@ -540,6 +547,7 @@ class SeccompPolicyBuilder
allowed_syscalls.insert(__NR_brk); // change data segment size
allowed_syscalls.insert(__NR_madvise); // give advice about use of memory
allowed_syscalls.insert(__NR_membarrier); // issue memory barriers on a set of threads
allowed_syscalls.insert(__NR_mincore); // check if virtual memory is in RAM
allowed_syscalls.insert(__NR_mlock); // lock memory
allowed_syscalls.insert(__NR_mmap); // map files or devices into memory
allowed_syscalls.insert(__NR_mprotect); // set protection on a region of memory
Expand Down Expand Up @@ -705,6 +713,7 @@ class SeccompPolicyBuilder
void AllowProcessStartOrDeath()
{
allowed_syscalls.insert(__NR_clone); // create a child process
allowed_syscalls.insert(__NR_clone3); // create a child process
allowed_syscalls.insert(__NR_exit); // terminate the calling process
allowed_syscalls.insert(__NR_exit_group); // exit all threads in a process
allowed_syscalls.insert(__NR_fork); // create a child process
Expand Down

0 comments on commit e418a8e

Please sign in to comment.