From: Serge Hallyn <serge.hallyn@ubuntu.com>
Date: Thu, 12 Nov 2015 23:22:48 +0000 (-0600)
Subject: seccomp: handle inverted arch
X-Git-Tag: lxc-2.0.0.beta1~52^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F697%2Fhead;p=thirdparty%2Flxc.git

seccomp: handle inverted arch

lxc uses uname to check the kernel version.  Seccomp respects userspace.  In the case
of 32-bit userspace on 64-bit kernel, this was a bad combination.

When we run into that case, make sure that the compat seccomp context is 32-bit, and
the lxc->seccomp_ctx is the 64-bit.

Closes #654

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
---

diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c
index 020864645..9eab6af9d 100644
--- a/src/lxc/seccomp.c
+++ b/src/lxc/seccomp.c
@@ -296,10 +296,19 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
 	if (native_arch == lxc_seccomp_arch_amd64) {
 		cur_rule_arch = lxc_seccomp_arch_all;
 		compat_arch = SCMP_ARCH_X86;
-		compat_ctx = get_new_ctx(lxc_seccomp_arch_i386,
-				default_policy_action);
-		if (!compat_ctx)
-			goto bad;
+		// Detect if we are on x86_64 kernel with 32-bit userspace
+		if (seccomp_arch_exist(conf->seccomp_ctx, SCMP_ARCH_X86)) {
+			compat_ctx = conf->seccomp_ctx;
+			conf->seccomp_ctx = get_new_ctx(lxc_seccomp_arch_amd64,
+					default_policy_action);
+			if (!conf->seccomp_ctx)
+				goto bad;
+		} else {
+			compat_ctx = get_new_ctx(lxc_seccomp_arch_i386,
+					default_policy_action);
+			if (!compat_ctx)
+				goto bad;
+		}
 	}
 
 	if (default_policy_action != SCMP_ACT_KILL) {