runc incompatibility: crun hangs when sendmsg is in the SCMP_ACT_NOTIFY list

[AkihiroSuda]

runc (v1.1.4) accepts the following .linux.seccomp configuration (sendmsg is in the SCMP_ACT_NOTIFY list), but crun (v1.5, also tested v0.19) just hangs.

    "seccomp": {
      "defaultAction": "SCMP_ACT_ALLOW",
      "listenerPath": "/tmp/foo.sock",
      "syscalls": [
        {
          "names": [
            "sendmsg"
          ],
          "action": "SCMP_ACT_NOTIFY"
        }
      ]
    }

Reproduction steps:

$ runc spec --rootless
$ vi config.json
(Add the seccomp config above)
$ ~/gopath/src/github.com/opencontainers/runc/contrib/cmd/seccompagent/seccompagent -socketfile=/tmp/foo.sock

(In another terminal)

$ runc run test-sendmsg
/ # exit
$ crun run test-sendmsg
(hangs)

Host: Ubuntu 22.04, kernel 5.15 (x86_64)

---

This is a blocker for running https://github.com/rootless-containers/bypass4netns with crun.

[AkihiroSuda]

Possible solution (similar to runc's implementation):

• Create a pipe, and fork the process before calling libcrun/seccomp.c:syscall_seccomp().
• The parent process calls syscall_seccomp(), gets the seccomp FD num as the return value, and then writes the FD num to the pipe, assuming write(2) is not on the SCMP_ACT_NOTIFY list. (If write(2) is on the list, maybe invoke some invalid syscall and raise SIGSYS to notify the child? Or maybe SIGSEGV?)
• The child process reads the FD num from the pipe, and calls pidfd_getfd() to get the actual seccomp FD. Then send the FD to the listenerPath using send_fd_to_socket_with_payload().
• The parent process waits for the child to exit, assuming wait4(-ish) is not on the SCMP_ACT_NOTIFY list (What if wait4 is on the list?)

The drawbacks are complexity and dependency on kernel >= 5.6.

[giuseppe]

thanks for the report: I've opened a PR: #1004

[giuseppe]

it uses a helper process that shares the fd table so it doesn't need pidfd_getfd() and the communication between processes is done with shared memory. No syscalls are invoked by the main process and you can notify every syscall