amaharaneko/guix-mirrors
1
1
Fork 0
mirror of https://codeberg.org/guix/guix.git synced 2025-10-02 02:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

daemon: Conditionally disable seccomp filter on ‘socketcall’ systems.

Browse source 
glibc currently will insist on using 'socketcall' on i686-linux unless built
with '--enable-kernel=4.3.0' or above, even on systems that have dedicated
system calls available for all the socket-related functionality.  This
behavior breaks the assumption that socketcall can be safely blocked without
impacting functionality in slirp4netns, rendering the seccomp filter unusable
with those glibcs.

This change makes the slirp4netns seccomp filter opt-in on systems with a
'socketcall' system call.  It can either be opted-into at compile-time or at
runtime using the NO_SOCKETCALL_LIBC preprocessor define or the
GUIX_FORCE_SECCOMP environment variable, respectively.

The seccomp filter being disabled on these systems means that it is possible
for a compromised slirp4netns to access abstract unix domain sockets in the
root network namespace.  It does not affect any of the other mechanisms used
to isolate slirp4netns (e.g. chroot, namespaces, etc).

Fixes guix/guix#808.

* nix/libstore/build.cc (spawnSlirp4netns) [__NR_socketcall]: Do not add
seccomp filter, unless ‘GUIX_FORCE_SECCOMP’ is set.

Change-Id: Ibfe8becc9431f5aff11a21f06858b20496f9cb4a
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
This commit is contained in:
Reepca Russelstein 2025-06-27 00:49:52 -05:00 • committed by Ludovic Courtès
parent 25522dab13
commit b79100ef61
No known key found for this signature in database
GPG key ID: 090B11993D9AEBB5
1 changed files with 18 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/libstore/build.cc
View file

@ -2219,8 +2219,24 @@ static pid_t spawnSlirp4netns(int tapfd, int notifyReadyFD,
slirpCtx.supplementaryGroups = {}; slirpCtx.supplementaryGroups = {};
slirpCtx.setSupplementaryGroups = true; slirpCtx.setSupplementaryGroups = true;
} }
slirpCtx.seccompFilter = slirpSeccompFilter(); /* Unless built with '--enable-kernel=4.3.0' or similar, glibc on i686
slirpCtx.addSeccompFilter = true; uses 'socketcall' instead of dedicated system calls like 'socket' and
'bind'. Since the seccomp filter cannot inspect 'socketcall' arguments
in a meaningful way, it can only prohibit all 'socketcall' calls; the
other option is to disable the seccomp filter entirely, meaning that
slirp4netns would have access to abstract unix sockets in the root
network namespace. */
#ifdef __NR_socketcall
#ifndef NO_SOCKETCALL_LIBC
if(getenv("GUIX_FORCE_SECCOMP") == NULL)
printMsg(lvlInfo, "warning: seccomp filter for slirp4netns presumed unusable with this libc, disabling it");
else
#endif
#endif
{
slirpCtx.seccompFilter = slirpSeccompFilter();
slirpCtx.addSeccompFilter = true;
}
/* Silence slirp4netns output unless requested */ /* Silence slirp4netns output unless requested */
if(verbosity <= lvlInfo) { if(verbosity <= lvlInfo) {