[lxc-devel] [lxc/lxc] 507981: seccomp: introduce v2 policy (v2)

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 507981388495a0bb338178e48b993bae753841d0
      https://github.com/lxc/lxc/commit/507981388495a0bb338178e48b993bae753841d0
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2014-02-12 (Wed, 12 Feb 2014)

  Changed paths:
    M src/lxc/seccomp.c

  Log Message:
  -----------
  seccomp: introduce v2 policy (v2)

v2 allows specifying system calls by name, and specifying
architecture.  A policy looks like:

2
whitelist
open
read
write
close
mount
[x86]
open
read

Also use SCMP_ACT_KILL by default rather than SCMP_ACT_ERRNO(31)  -
which confusingly returns 'EMLINK' on x86_64.  Note this change
is also done for v1 as I think it is worthwhile.

With this patch, I can in fact use a seccomp policy like:

2
blacklist
mknod errno 0

after which 'sudo mknod null c 1 3' silently succeeds without
creating the null device.

changelog v2:
  add blacklist support
  support default action
  support per-rule action

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: e7de366c67fd6f9f0b0675c1d6d8428d3834eaf2
      https://github.com/lxc/lxc/commit/e7de366c67fd6f9f0b0675c1d6d8428d3834eaf2
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-02-12 (Wed, 12 Feb 2014)

  Changed paths:
    M src/lxc/lxccontainer.c

  Log Message:
  -----------
  coverity: Free bdev in clone_update_rootfs

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 57d2be5493cddf9a08db9c7e7c077078c3fdce2b
      https://github.com/lxc/lxc/commit/57d2be5493cddf9a08db9c7e7c077078c3fdce2b
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-02-12 (Wed, 12 Feb 2014)

  Changed paths:
    M src/lxc/utils.c

  Log Message:
  -----------
  coverity: Check return value of fcntl in lxc_popen

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 119126b6fc130ff4c61fe5338cfd58f87e938ab2
      https://github.com/lxc/lxc/commit/119126b6fc130ff4c61fe5338cfd58f87e938ab2
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-02-12 (Wed, 12 Feb 2014)

  Changed paths:
    M src/lxc/conf.c

  Log Message:
  -----------
  coverity: Always check mkdir_p's return value

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 35e3a0cdf7884010f1a2ea806960003337798d6a
      https://github.com/lxc/lxc/commit/35e3a0cdf7884010f1a2ea806960003337798d6a
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-02-12 (Wed, 12 Feb 2014)

  Changed paths:
    M src/lxc/lxc_usernsexec.c

  Log Message:
  -----------
  coverity: check return value of fcntl in usernsexec

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 4ad9f44bcdc0bdf100f563d75e16d985886b2a26
      https://github.com/lxc/lxc/commit/4ad9f44bcdc0bdf100f563d75e16d985886b2a26
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-02-12 (Wed, 12 Feb 2014)

  Changed paths:
    M src/lxc/conf.c

  Log Message:
  -----------
  coverity: Don't store fgets return value if we don't use it

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/1f92162dc043...4ad9f44bcdc0