From 473ebc77d6762c2ec49fe59983dabc04f695fd01 Mon Sep 17 00:00:00 2001 From: Serge Hallyn Date: Thu, 12 Nov 2015 17:22:48 -0600 Subject: [PATCH] seccomp: handle inverted arch lxc uses uname to check the kernel version. Seccomp respects userspace. In the case of 32-bit userspace on 64-bit kernel, this was a bad combination. When we run into that case, make sure that the compat seccomp context is 32-bit, and the lxc->seccomp_ctx is the 64-bit. Closes #654 Signed-off-by: Serge Hallyn --- src/lxc/seccomp.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c index 020864645..9eab6af9d 100644 --- a/src/lxc/seccomp.c +++ b/src/lxc/seccomp.c @@ -296,10 +296,19 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf) if (native_arch == lxc_seccomp_arch_amd64) { cur_rule_arch = lxc_seccomp_arch_all; compat_arch = SCMP_ARCH_X86; - compat_ctx = get_new_ctx(lxc_seccomp_arch_i386, - default_policy_action); - if (!compat_ctx) - goto bad; + // Detect if we are on x86_64 kernel with 32-bit userspace + if (seccomp_arch_exist(conf->seccomp_ctx, SCMP_ARCH_X86)) { + compat_ctx = conf->seccomp_ctx; + conf->seccomp_ctx = get_new_ctx(lxc_seccomp_arch_amd64, + default_policy_action); + if (!conf->seccomp_ctx) + goto bad; + } else { + compat_ctx = get_new_ctx(lxc_seccomp_arch_i386, + default_policy_action); + if (!compat_ctx) + goto bad; + } } if (default_policy_action != SCMP_ACT_KILL) { -- 2.47.2