Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for seccomp actions ActKillThread and ActKillProcess #3204

Merged
merged 2 commits into from
Sep 9, 2021
Merged

Add support for seccomp actions ActKillThread and ActKillProcess #3204

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4a751b0
seccomp: drop unnecessary const SCMP_ACT_* defines
cyphar Sep 9, 2021
4a4d4f1
Add support for seccomp actions ActKillThread and ActKillProcess
saschagrunert Jul 28, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions libcontainer/configs/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,8 @@ const (
Trace
Log
Notify
KillThread
KillProcess
)

// Operator is a comparison operator to be used when matching syscall arguments in Seccomp
Expand Down
25 changes: 12 additions & 13 deletions libcontainer/seccomp/seccomp_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,8 @@ import (
)

var (
actAllow = libseccomp.ActAllow
actTrap = libseccomp.ActTrap
actKill = libseccomp.ActKill
actTrace = libseccomp.ActTrace.SetReturnCode(int16(unix.EPERM))
actLog = libseccomp.ActLog
actErrno = libseccomp.ActErrno.SetReturnCode(int16(unix.EPERM))
actNotify = libseccomp.ActNotify
actTrace = libseccomp.ActTrace.SetReturnCode(int16(unix.EPERM))
actErrno = libseccomp.ActErrno.SetReturnCode(int16(unix.EPERM))
)

const (
Expand Down Expand Up @@ -71,7 +66,7 @@ func InitSeccomp(config *configs.Seccomp) (int, error) {
}

// See comment on why write is not allowed. The same reason applies, as this can mean handling write too.
if defaultAction == actNotify {
if defaultAction == libseccomp.ActNotify {
return -1, errors.New("SCMP_ACT_NOTIFY cannot be used as default action")
}

Expand Down Expand Up @@ -119,25 +114,29 @@ func InitSeccomp(config *configs.Seccomp) (int, error) {
func getAction(act configs.Action, errnoRet *uint) (libseccomp.ScmpAction, error) {
switch act {
case configs.Kill:
return actKill, nil
return libseccomp.ActKill, nil
case configs.Errno:
if errnoRet != nil {
return libseccomp.ActErrno.SetReturnCode(int16(*errnoRet)), nil
}
return actErrno, nil
case configs.Trap:
return actTrap, nil
return libseccomp.ActTrap, nil
case configs.Allow:
return actAllow, nil
return libseccomp.ActAllow, nil
case configs.Trace:
if errnoRet != nil {
return libseccomp.ActTrace.SetReturnCode(int16(*errnoRet)), nil
}
return actTrace, nil
case configs.Log:
return actLog, nil
return libseccomp.ActLog, nil
case configs.Notify:
return actNotify, nil
return libseccomp.ActNotify, nil
case configs.KillThread:
return libseccomp.ActKillThread, nil
case configs.KillProcess:
return libseccomp.ActKillProcess, nil
default:
return libseccomp.ActInvalid, errors.New("invalid action, cannot use in rule")
}
Expand Down