seccomp: remove '@credentials' syscall set (#6958)

This removes the '@credentials' syscall set that was added in commit
v234-468-gcd0ddf6f75.

Most of these syscalls are so simple that we do not want to filter them.
They work on the current calling process, doing only read operations,
they do not have a deep kernel path.

The problem may only be in 'capget' syscall since it can query arbitrary
processes, and used to discover processes, however sending signal 0 to
arbitrary processes can be used to discover if a process exists or not.
It is unfortunate that Linux allows to query processes of different
users. Lets put it now in '@process' syscall set, and later we may add
it to a new '@basic-process' set that allows most basic process
operations.

diff --git a/NEWS b/NEWS
index c0a8ed395f330726b4f7036fa7206f629e3229a6..e639f4878f1387174005fd07a1a1bd6fdc6e7c8d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -121,8 +121,8 @@ CHANGES WITH 235:
           each time the service is restarted due to Restart=, and may be
           queried using "systemctl show -p NRestarts …".
 
-        * New system call filter groups @setuid, @credentials, @memlock,
-          @signal and @timer have been added, for usage with SystemCallFilter=
+        * New system call filter groups @setuid, @memlock, @signal and
+          @timer have been added, for usage with SystemCallFilter=
           in unit files and the new --system-call-filter= command line option
           of systemd-nspawn (see above).
 

diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index 02d2e9e25989737cbe07dde608b7e416a92c2e39..9c5be21053c162673e4d3456edb6e829c3908cdb 100644 (file)
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -1502,10 +1502,6 @@ CapabilityBoundingSet=~CAP_B CAP_C</programlisting>
                 <entry>@cpu-emulation</entry>
                 <entry>System calls for CPU emulation functionality (<citerefentry project='man-pages'><refentrytitle>vm86</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)</entry>
               </row>
-              <row>
-                <entry>@credentials</entry>
-                <entry>System calls for querying process credentials (<citerefentry project='man-pages'><refentrytitle>getuid</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>capget</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)</entry>
-              </row>
               <row>
                 <entry>@debug</entry>
                 <entry>Debugging, performance monitoring and tracing functionality (<citerefentry project='man-pages'><refentrytitle>ptrace</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>perf_event_open</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)</entry>

diff --git a/src/nspawn/nspawn-seccomp.c b/src/nspawn/nspawn-seccomp.c
index db3d098e7f86169cd6f68f64e5f4faa7afdc5276..38c2b12e9522250300982a59f7a9d3a2ebc5765f 100644 (file)
--- a/src/nspawn/nspawn-seccomp.c
+++ b/src/nspawn/nspawn-seccomp.c
@@ -50,7 +50,6 @@ static int seccomp_add_default_syscall_filter(
         } whitelist[] = {
                 /* Let's use set names where we can */
                 { 0,                  "@basic-io"              },
-                { 0,                  "@credentials"           },
                 { 0,                  "@default"               },
                 { 0,                  "@file-system"           },
                 { 0,                  "@io-event"              },
@@ -71,6 +70,7 @@ static int seccomp_add_default_syscall_filter(
 
                 /* Plus a good set of additional syscalls which are not part of any of the groups above */
                 { 0,                  "brk"                    },
+                { 0,                  "capget"                 },
                 { 0,                  "capset"                 },
                 { 0,                  "chown"                  },
                 { 0,                  "chown32"                },

diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 5e78a088e9f9031672c651c64b459b6e3c82be4d..a7720c53dcbfe44b8612d3851edb88149ecb78bc 100644 (file)
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -281,8 +281,28 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "futex\0"
                 "get_robust_list\0"
                 "get_thread_area\0"
+                "getegid\0"
+                "getegid32\0"
+                "geteuid\0"
+                "geteuid32\0"
+                "getgid\0"
+                "getgid32\0"
+                "getgroups\0"
+                "getgroups32\0"
+                "getpgid\0"
+                "getpgrp\0"
+                "getpid\0"
+                "getppid\0"
+                "getresgid\0"
+                "getresgid32\0"
+                "getresuid\0"
+                "getresuid32\0"
                 "getrlimit\0"      /* make sure processes can query stack size and such */
+                "getsid\0"
+                "gettid\0"
                 "gettimeofday\0"
+                "getuid\0"
+                "getuid32\0"
                 "membarrier\0"
                 "nanosleep\0"
                 "pause\0"
@@ -333,32 +353,6 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "vm86\0"
                 "vm86old\0"
         },
-        [SYSCALL_FILTER_SET_CREDENTIALS] = {
-                .name = "@credentials",
-                .help = "Query own process credentials",
-                .value =
-                "capget\0"
-                "getegid\0"
-                "getegid32\0"
-                "geteuid\0"
-                "geteuid32\0"
-                "getgid\0"
-                "getgid32\0"
-                "getgroups\0"
-                "getgroups32\0"
-                "getpgid\0"
-                "getpgrp\0"
-                "getpid\0"
-                "getppid\0"
-                "getresgid\0"
-                "getresgid32\0"
-                "getresuid\0"
-                "getresuid32\0"
-                "getsid\0"
-                "gettid\0"
-                "getuid\0"
-                "getuid32\0"
-        },
         [SYSCALL_FILTER_SET_DEBUG] = {
                 .name = "@debug",
                 .help = "Debugging, performance monitoring and tracing functionality",
@@ -645,11 +639,10 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 .help = "Process control, execution, namespaceing operations",
                 .value =
                 "arch_prctl\0"
+                "capget\0"      /* Able to query arbitrary processes */
                 "clone\0"
                 "execveat\0"
                 "fork\0"
-                "getpid\0"
-                "getppid\0"
                 "getrusage\0"
                 "gettid\0"
                 "kill\0"

diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h
index d4ff027df8b3b0f82a8e25cd2bc56e635b1257e1..25ca9bcaa037b0e1080ab28906f0de2e2c70d5a9 100644 (file)
--- a/src/shared/seccomp-util.h
+++ b/src/shared/seccomp-util.h
@@ -44,7 +44,6 @@ enum {
         SYSCALL_FILTER_SET_BASIC_IO,
         SYSCALL_FILTER_SET_CLOCK,
         SYSCALL_FILTER_SET_CPU_EMULATION,
-        SYSCALL_FILTER_SET_CREDENTIALS,
         SYSCALL_FILTER_SET_DEBUG,
         SYSCALL_FILTER_SET_FILE_SYSTEM,
         SYSCALL_FILTER_SET_IO_EVENT,