seccomp: notifier fixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

diff --git a/src/lxc/af_unix.c b/src/lxc/af_unix.c
index 275430a52a2a0e5347a895784dc31517927bdb07..7f0711ed224d990033ec50531917bb55f7a937f1 100644 (file)
--- a/src/lxc/af_unix.c
+++ b/src/lxc/af_unix.c
@@ -365,18 +365,23 @@ int lxc_unix_connect(struct sockaddr_un *addr)
        int ret;
        ssize_t len;
 
-       fd = socket(PF_UNIX, SOCK_STREAM, SOCK_CLOEXEC);
-       if (fd < 0)
+       fd = socket(AF_UNIX, SOCK_STREAM, 0);
+       if (fd < 0) {
+               SYSERROR("Failed to open new AF_UNIX socket");
                return -1;
+       }
 
        if (addr->sun_path[0] == '\0')
                len = strlen(&addr->sun_path[1]);
        else
                len = strlen(&addr->sun_path[0]);
-       ret = connect(fd, (struct sockaddr *)&addr,
-                     offsetof(struct sockaddr_un, sun_path) + len + 1);
-       if (ret < 0)
+
+       ret = connect(fd, (struct sockaddr *)addr,
+                     offsetof(struct sockaddr_un, sun_path) + len);
+       if (ret < 0) {
+               SYSERROR("Failed to bind new AF_UNIX socket");
                return -1;
+       }
 
        return move_fd(fd);
 }

diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 331434b26836bef1ad125bc51cd266f282c1f850..9d37793e5cfdea0112568bc561265215b34137a9 100644 (file)
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -1317,13 +1317,15 @@ int lxc_attach(const char *name, const char *lxcpath,
                        TRACE("Sent LSM label file descriptor %d to child", labelfd);
                }
 
-               ret = lxc_seccomp_recv_notifier_fd(&conf->seccomp, ipc_sockets[0]);
-               if (ret < 0)
-                       goto close_mainloop;
+               if (conf && conf->seccomp.seccomp) {
+                       ret = lxc_seccomp_recv_notifier_fd(&conf->seccomp, ipc_sockets[0]);
+                       if (ret < 0)
+                               goto close_mainloop;
 
-               ret = lxc_seccomp_add_notifier(name, lxcpath, &conf->seccomp);
-               if (ret < 0)
-                       goto close_mainloop;
+                       ret = lxc_seccomp_add_notifier(name, lxcpath, &conf->seccomp);
+                       if (ret < 0)
+                               goto close_mainloop;
+               }
 
                /* We're done, the child process should now execute whatever it
                 * is that the user requested. The parent can now track it with

diff --git a/src/lxc/lxcseccomp.h b/src/lxc/lxcseccomp.h
index aafe09f127320d5670f16e4fcfcbc21538a69347..afb3e73527d8a9de317ee679a217ab3ad07d0814 100644 (file)
--- a/src/lxc/lxcseccomp.h
+++ b/src/lxc/lxcseccomp.h
@@ -79,9 +79,9 @@ extern void lxc_seccomp_free(struct lxc_seccomp *seccomp);
 extern int seccomp_notify_handler(int fd, uint32_t events, void *data,
                                  struct lxc_epoll_descr *descr);
 extern void seccomp_conf_init(struct lxc_conf *conf);
-extern int lxc_seccomp_setup_notifier(struct lxc_seccomp *seccomp,
-                                     struct lxc_epoll_descr *descr,
-                                     struct lxc_handler *handler);
+extern int lxc_seccomp_setup_proxy(struct lxc_seccomp *seccomp,
+                                  struct lxc_epoll_descr *descr,
+                                  struct lxc_handler *handler);
 extern int lxc_seccomp_send_notifier_fd(struct lxc_seccomp *seccomp,
                                        int socket_fd);
 extern int lxc_seccomp_recv_notifier_fd(struct lxc_seccomp *seccomp,
@@ -129,9 +129,9 @@ static inline void seccomp_conf_init(struct lxc_conf *conf)
 {
 }
 
-static inline int lxc_seccomp_setup_notifier(struct lxc_seccomp *seccomp,
-                                            struct lxc_epoll_descr *descr,
-                                            struct lxc_handler *handler)
+static inline int lxc_seccomp_setup_proxy(struct lxc_seccomp *seccomp,
+                                         struct lxc_epoll_descr *descr,
+                                         struct lxc_handler *handler)
 {
        return 0;
 }

diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c
index a63b6d69fb9b0d979b9c12c78519a22365dbce82..34abda16a9fa8a7215fc45b2a04aaa6d599bf3f8 100644 (file)
--- a/src/lxc/seccomp.c
+++ b/src/lxc/seccomp.c
@@ -1410,9 +1410,9 @@ void seccomp_conf_init(struct lxc_conf *conf)
 #endif
 }
 
-int lxc_seccomp_setup_notifier(struct lxc_seccomp *seccomp,
-                              struct lxc_epoll_descr *descr,
-                              struct lxc_handler *handler)
+int lxc_seccomp_setup_proxy(struct lxc_seccomp *seccomp,
+                           struct lxc_epoll_descr *descr,
+                           struct lxc_handler *handler)
 {
 #if HAVE_DECL_SECCOMP_NOTIF_GET_FD
        if (seccomp->notifier.wants_supervision &&
@@ -1421,20 +1421,32 @@ int lxc_seccomp_setup_notifier(struct lxc_seccomp *seccomp,
                int ret;
 
                notify_fd = lxc_unix_connect(&seccomp->notifier.proxy_addr);
-               if (notify_fd < 0)
+               if (notify_fd < 0) {
+                       SYSERROR("Failed to connect to seccomp proxy");
                        return -1;
+               }
 
                /* 30 second timeout */
                ret = lxc_socket_set_timeout(notify_fd, 30, 30);
-               if (ret)
+               if (ret) {
+                       SYSERROR("Failed to set timeouts for seccomp proxy");
                        return -1;
+               }
+
+               ret = seccomp_notif_alloc(&seccomp->notifier.req_buf,
+                                         &seccomp->notifier.rsp_buf);
+               if (ret) {
+                       ERROR("Failed to allocate seccomp notify request and response buffers");
+                       errno = ret;
+                       return -1;
+               }
 
                ret = lxc_mainloop_add_handler(descr,
                                               seccomp->notifier.notify_fd,
                                               seccomp_notify_handler, handler);
                if (ret < 0) {
                        ERROR("Failed to add seccomp notify handler for %d to mainloop",
-                             seccomp->notifier.notify_fd);
+                             notify_fd);
                        return -1;
                }
 
@@ -1469,15 +1481,6 @@ int lxc_seccomp_recv_notifier_fd(struct lxc_seccomp *seccomp, int socket_fd)
                                                 1, NULL, 0);
                if (ret < 0)
                        return -1;
-
-               if (seccomp->notifier.proxy_fd >= 0) {
-                       ret = seccomp_notif_alloc(&seccomp->notifier.req_buf,
-                                                 &seccomp->notifier.rsp_buf);
-                       if (ret) {
-                               errno = ret;
-                               return -1;
-                       }
-               }
        }
 #endif
        return 0;
@@ -1488,11 +1491,11 @@ int lxc_seccomp_add_notifier(const char *name, const char *lxcpath,
 {
 
 #if HAVE_DECL_SECCOMP_NOTIF_GET_FD
-       if (seccomp->notifier.proxy_fd >= 0) {
+       if (seccomp->notifier.wants_supervision) {
                int ret;
 
                ret = lxc_cmd_seccomp_notify_add_listener(name, lxcpath,
-                                                         seccomp->notifier.notify_fd,
+                                                         seccomp->notifier.notify_fd,
                                                          -1, 0);
                close_prot_errno_disarm(seccomp->notifier.notify_fd);
                if (ret < 0)

diff --git a/src/lxc/start.c b/src/lxc/start.c
index a72970fdf19c662cdba94073feb39875b69ac2ef..5209af35864f28eab057b2cf63b16bf873b03738 100644 (file)
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -591,9 +591,11 @@ int lxc_poll(const char *name, struct lxc_handler *handler)
                goto out_mainloop_console;
        }
 
-       ret = lxc_seccomp_setup_notifier(&handler->conf->seccomp, &descr, handler);
-       if (ret < 0)
+       ret = lxc_seccomp_setup_proxy(&handler->conf->seccomp, &descr, handler);
+       if (ret < 0) {
+               ERROR("Failed to setup seccomp proxy");
                goto out_mainloop_console;
+       }
 
        if (has_console) {
                struct lxc_terminal *console = &handler->conf->console;