Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

seccomp: patchbpf: always include native architecture in stub #4219

Merged
merged 2 commits into from
Mar 29, 2024
Merged

seccomp: patchbpf: always include native architecture in stub #4219

merged 2 commits into from
Mar 29, 2024

Commits on Mar 29, 2024

  1. seccomp: patchbpf: rename nativeArch -> linuxAuditArch 

    Calling the Linux AUDIT_* architecture constants "native" leads to
confusing code when we are getting the actual native architecture of the
running system.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
    @cyphar
    cyphar committed Mar 29, 2024
    Configuration menu
    Copy the full SHA
    b288abe View commit details
    Browse the repository at this point in the history

  2. seccomp: patchbpf: always include native architecture in stub 

    It turns out that on ppc64le (at least), Docker doesn't include any
architectures in the list of allowed architectures. libseccomp
interprets this as "just include the default architecture" but patchbpf
would return a no-op ENOSYS stub, which would lead to the exact issues
that commit 7a8d716 ("seccomp: prepend -ENOSYS stub to all
filters") fixed for other architectures.

So, just always include the running architecture in the list. There's
no real downside.

Ref: https://bugzilla.suse.com/show_bug.cgi?id=1192051#c6
Reported-by: Fabian Vogt <fvogt@suse.com>
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
    @cyphar
    cyphar committed Mar 29, 2024
    Configuration menu
    Copy the full SHA
    ccc500c View commit details
    Browse the repository at this point in the history