From: Lennart Poettering Date: Wed, 13 Sep 2017 17:55:16 +0000 (+0200) Subject: seccomp: add four new syscall groups X-Git-Tag: v235~107^2~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cd0ddf6f754ec364c0ec69bd4bb51f566065290e;p=thirdparty%2Fsystemd.git seccomp: add four new syscall groups These groups should be useful shortcuts for sets of closely related syscalls where it usually makes more sense to allow them altogether or not at all. --- diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 625063f1c0e..edc070f6ea2 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1461,6 +1461,10 @@ CapabilityBoundingSet=~CAP_B CAP_C @cpu-emulation System calls for CPU emulation functionality (vm862 and related calls) + + @credentials + System calls for querying process credentials (getuid2, capget2, and related calls) + @debug Debugging, performance monitoring and tracing functionality (ptrace2, perf_event_open2 and related calls) @@ -1481,6 +1485,10 @@ CapabilityBoundingSet=~CAP_B CAP_C @keyring Kernel keyring access (keyctl2 and related calls) + + @memlock + Locking of memory into RAM (mlock2, mlockall2 and related calls) + @module Loading and unloading of kernel modules (init_module2, delete_module2 and related calls) @@ -1521,10 +1529,18 @@ CapabilityBoundingSet=~CAP_B CAP_C @setuid System calls for changing user ID and group ID credentials, (setuid2, setgid2, setresuid2, …) + + @signal + System calls for manipulating and handling process signals (signal2, sigprocmask2, …) + @swap System calls for enabling/disabling swap devices (swapon2, swapoff2) + + @timer + System calls for scheduling operations by time (alarm2, timer_create2, …) + diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index f4f4eb36d37..e282469155b 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -333,6 +333,32 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "vm86\0" "vm86old\0" }, + [SYSCALL_FILTER_SET_CREDENTIALS] = { + .name = "@credentials", + .help = "Query own process credentials", + .value = + "capget\0" + "getegid\0" + "getegid32\0" + "geteuid\0" + "geteuid32\0" + "getgid\0" + "getgid32\0" + "getgroups\0" + "getgroups32\0" + "getpgid\0" + "getpgrp\0" + "getpid\0" + "getppid\0" + "getresgid\0" + "getresgid32\0" + "getresuid\0" + "getresuid32\0" + "getsid\0" + "gettid\0" + "getuid\0" + "getuid32\0" + }, [SYSCALL_FILTER_SET_DEBUG] = { .name = "@debug", .help = "Debugging, performance monitoring and tracing functionality", @@ -487,6 +513,16 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "keyctl\0" "request_key\0" }, + [SYSCALL_FILTER_SET_MEMLOCK] = { + .name = "@memlock", + .help = "Memory locking control", + .value = + "mlock\0" + "mlock2\0" + "mlockall\0" + "munlock\0" + "munlockall\0" + }, [SYSCALL_FILTER_SET_MODULE] = { .name = "@module", .help = "Loading and unloading of kernel modules", @@ -691,6 +727,24 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "setuid\0" "setuid32\0" }, + [SYSCALL_FILTER_SET_SIGNAL] = { + .name = "@signal", + .help = "Process signal handling", + .value = + "rt_sigaction\0" + "rt_sigpending\0" + "rt_sigprocmask\0" + "rt_sigsuspend\0" + "rt_sigtimedwait\0" + "sigaction\0" + "sigaltstack\0" + "signal\0" + "signalfd\0" + "signalfd4\0" + "sigpending\0" + "sigprocmask\0" + "sigsuspend\0" + }, [SYSCALL_FILTER_SET_SWAP] = { .name = "@swap", .help = "Enable/disable swap devices", @@ -698,6 +752,23 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "swapoff\0" "swapon\0" }, + [SYSCALL_FILTER_SET_TIMER] = { + .name = "@timer", + .help = "Schedule operations by time", + .value = + "alarm\0" + "getitimer\0" + "setitimer\0" + "timer_create\0" + "timer_delete\0" + "timer_getoverrun\0" + "timer_gettime\0" + "timer_settime\0" + "timerfd_create\0" + "timerfd_gettime\0" + "timerfd_settime\0" + "times\0" + }, }; const SyscallFilterSet *syscall_filter_set_find(const char *name) { diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h index c1612f58949..d4ff027df8b 100644 --- a/src/shared/seccomp-util.h +++ b/src/shared/seccomp-util.h @@ -44,11 +44,13 @@ enum { SYSCALL_FILTER_SET_BASIC_IO, SYSCALL_FILTER_SET_CLOCK, SYSCALL_FILTER_SET_CPU_EMULATION, + SYSCALL_FILTER_SET_CREDENTIALS, SYSCALL_FILTER_SET_DEBUG, SYSCALL_FILTER_SET_FILE_SYSTEM, SYSCALL_FILTER_SET_IO_EVENT, SYSCALL_FILTER_SET_IPC, SYSCALL_FILTER_SET_KEYRING, + SYSCALL_FILTER_SET_MEMLOCK, SYSCALL_FILTER_SET_MODULE, SYSCALL_FILTER_SET_MOUNT, SYSCALL_FILTER_SET_NETWORK_IO, @@ -59,7 +61,9 @@ enum { SYSCALL_FILTER_SET_REBOOT, SYSCALL_FILTER_SET_RESOURCES, SYSCALL_FILTER_SET_SETUID, + SYSCALL_FILTER_SET_SIGNAL, SYSCALL_FILTER_SET_SWAP, + SYSCALL_FILTER_SET_TIMER, _SYSCALL_FILTER_SET_MAX };