From a60c98aaf637f3cb8ef6b054cceab666d2317615 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Mon, 2 Nov 2020 16:44:05 +0100 Subject: [PATCH] seccomp: make seccomp notifier fd non-blocking Suggested-by: Jann Horn Signed-off-by: Christian Brauner --- src/lxc/file_utils.c | 12 ++++++++++++ src/lxc/file_utils.h | 1 + src/lxc/seccomp.c | 3 +++ 3 files changed, 16 insertions(+) diff --git a/src/lxc/file_utils.c b/src/lxc/file_utils.c index 4a8c7a8d9..fafaba354 100644 --- a/src/lxc/file_utils.c +++ b/src/lxc/file_utils.c @@ -577,3 +577,15 @@ int open_beneath(int dir_fd, const char *path, unsigned int flags) return openat(dir_fd, path, O_NOFOLLOW | flags); } + +int fd_make_nonblocking(int fd) +{ + int flags; + + flags = fcntl(fd, F_GETFL); + if (flags < 0) + return -1; + + flags &= ~O_NONBLOCK; + return fcntl(fd, F_SETFL, flags); +} diff --git a/src/lxc/file_utils.h b/src/lxc/file_utils.h index df3a00d4d..ea9570dd1 100644 --- a/src/lxc/file_utils.h +++ b/src/lxc/file_utils.h @@ -76,5 +76,6 @@ __hidden extern int timens_offset_write(clockid_t clk_id, int64_t s_offset, int6 __hidden extern bool exists_dir_at(int dir_fd, const char *path); __hidden extern bool exists_file_at(int dir_fd, const char *path); __hidden extern int open_beneath(int dir_fd, const char *path, unsigned int flags); +__hidden int fd_make_nonblocking(int fd); #endif /* __LXC_FILE_UTILS_H */ diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c index 4faf693f6..e303561bf 100644 --- a/src/lxc/seccomp.c +++ b/src/lxc/seccomp.c @@ -1280,6 +1280,9 @@ int lxc_seccomp_load(struct lxc_conf *conf) return -1; } + if (fd_make_nonblocking(ret)) + return log_error_errno(-1, errno, "Failed to make seccomp listener fd non-blocking");; + conf->seccomp.notifier.notify_fd = ret; TRACE("Retrieved new seccomp listener fd %d", ret); } -- 2.47.2