Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
Already on GitHub? Sign in to your account
interfaces: simplify snap-confine by just loading pre-generated bpf code #3431
Merged
Commits
Show all changes
95 commits
Select commit
Hold shift + click to select a range
66a94a3
add first sketch of seccomp -> bpf compiler
mvo5 9bbcd97
install snap-seccomp to /usr/lib/snapd
mvo5 e8c1799
make snap-confine load the bpf directly
mvo5 a2e13bd
use generated bpf in snap-confine
mvo5 56896a0
add SNAP_CONFINE_DUMP_OLD_SECCOMP and more tweaks
mvo5 ba48d7b
remove extra prctl(PR_SET_NO_NEW_PRIVS)
mvo5 4d021ae
add proper secondary arch handling
mvo5 e8e0514
ensure all bpf is compiled
mvo5 ba3888d
fix silly string handling error
mvo5 bb29170
add @unrestricted support
mvo5 b58a542
add test skeletons, need more work
mvo5 771dae9
add TestCompile
mvo5 fa573e9
improve tests
mvo5 5bf5540
add simulation for argument filtering too
mvo5 dde305b
remove old seccomp-support.c code that is now handled via libseccomp-…
mvo5 b1d6a1f
use github.com/mvo5/net/bpf until https://github.com/golang/go/issues…
mvo5 e5eb777
Merge remote-tracking branch 'upstream/master' into seccomp-bpf
mvo5 3fd764e
remove merge artifact
mvo5 4442dab
use syscall package instead of C when possible
mvo5 dcf4611
remove no longer needed includes from seccomp-support.c
mvo5 c9b3dfc
move raising privs closer to prctl were it is really needed
mvo5 76f1db4
improve sc_apply_seccomp_bpf() read code
mvo5 847f892
improve seccomp-support comment
mvo5 ceef4a8
improve error message from seccomp-support.c if prctl() fails
mvo5 62e4c2b
add basic bpf validation based on valid opcodes
mvo5 396258d
ensure profile_path is entirely root owned before using it (TOCTTOU s…
mvo5 7a6750f
add spread test for profile validation in snap-confine
mvo5 77a6c0e
update security-profiles spread test
mvo5 d0c76d2
update seccomp backend unit tests for the new code
mvo5 f03a8ae
update manager unit tests
mvo5 5dafe3f
start porting sh based snap-confine tests to the new seccomp-bpf world
mvo5 0a36dcd
disable snap-confine sh-based tests for now
mvo5 86ea145
address review feedback, thanks to jdstrand
mvo5 bf85a1a
port test_bad_seccomp_filter_* tests
mvo5 2949819
port test_restrictions_working_args_* to unit tests
mvo5 6f14922
port test_{complain,unrestricted}{,_missed} to spread
mvo5 6905b97
disable check for stat_buf.st_mode & S_IWOTH in validate_path_has_str…
mvo5 8536f7e
address more review feedback (thanks to jdstrand)
mvo5 47ae906
make snap-seccomp build on 14.04
mvo5 70a714c
improve debug when validate_path_has_strict_perms fails
mvo5 1ccce45
ensure sc_quirk_create_writable_mimic() sets up the right permissions
mvo5 e3f2e9f
fix test failure with tests/regression/lp-1641885
mvo5 c260fda
fix formating sting error during build
mvo5 a32a91d
ignore mispell of PROCES,PROCESSS
mvo5 1e462f6
install snap-seccomp in fedora/suse too
mvo5 dcfae66
add fixup code for incorrect 1777 permissions in /var/lib
mvo5 4931f6e
Use `/var/lib/snapd/seccomp/bpf` to store the bpf profiles
mvo5 91da609
also ignore lower-case proces,processs mispellings
mvo5 123b438
Merge remote-tracking branch 'upstream/master' into seccomp-bpf
mvo5 0da9d0e
skip snap-seccomp tests on non-strict systems
mvo5 c97916b
fix typo
mvo5 1605b1e
remove validate_bpf() code as discussed with jdstrand and gustavo
mvo5 b9c5004
ignore all errors from seccomp.GetSyscallFromName() for now (thanks j…
mvo5 205c52a
Add support for kernel != userland snapd in seccomp
mvo5 dfa81cb
only allow @unrestricted or @complain in their own lines
mvo5 7a5c354
update snap-seccomp test now that opcode filtering is gone
mvo5 6428412
set MAX_BPF_SIZE to 32k
mvo5 faf20a5
fix review feedback, mostly typos plus extra code removals (thanks to…
mvo5 3bd5a6a
improve comments in TestCompile and explain better what it is doing
mvo5 5a72a9c
add missing tests from test_bad_seccomp_filter_args
mvo5 b259b03
add missing NETLINK_ROUT/NETLINK_ROUTEE/NETLINK_R0UTE tests
mvo5 dbdef16
allow "-" in TestCompile bpfInput
mvo5 e51e40c
add missing tests for Q_SYNC, Q_XQUOTAON, Q_XQUOTAOFF, Q_XGETQUOTA, Q…
mvo5 665828a
improve failure output in tests/main/snap-seccomp
mvo5 978520f
reshuffle and create TestRestrictionsWorkingArgsClone,TestRestriction…
mvo5 0adfade
remove tests/main/snap-confine, this is better tested in tests/main/s…
mvo5 6a4311a
remove old-style snap-confine unit/integration shell tests
mvo5 90a7f0e
fix typo, improve comment
mvo5 f64670a
make fmt
mvo5 ff91f82
update snap-seccomp test for size check
mvo5 2be69cf
Merge remote-tracking branch 'upstream/master' into seccomp-bpf
mvo5 2d80225
more review feedback
mvo5 5811a94
add integration test for missing .bpf file and for empty seccomp profile
mvo5 bc7f69d
make snap-confine.rst file section more accurate.
mvo5 f415a23
rework addSecondaryArches() to be closer to the C implementation
mvo5 4046034
add setpriority 1\\n2 parser test
mvo5 1e0260b
change seccomp profile dir to /var/lib/snapd/seccomp/profiles.bpf
mvo5 aad59d6
do not use the .in extension for seccomp input files, just snap.$secu…
mvo5 7367842
use profiles.bpf as SnapSeccompDir
mvo5 edb92ec
improve architecture handling in snap-seccomp
mvo5 ec1d9ca
add test for compat arch
mvo5 fc3d8af
Merge branch 'nudge-poor-apt' into seccomp-bpf
mvo5 99f6d2c
fix ARCH_BAD on 14.04
mvo5 8ff0621
Merge remote-tracking branch 'upstream/master' into seccomp-bpf
mvo5 2189800
fix incorrect comment
mvo5 6ab9f32
add comment to simulateBpf (thanks to jdstrand)
mvo5 8cf544a
fix typo (thanks to jdstrand)
mvo5 0c7f5fa
address review feedback (thanks to jdstrand)
mvo5 02fba6f
make fmt
mvo5 26b2591
ensure the right snap-seccomp is used when snapd is re-execed
mvo5 1d04d77
address review comments (thanks to Gustavo)
mvo5 a135a71
scan content in snap-seccomp:compile() only once
mvo5 dde3e76
make argument handling (slightly) more robust
mvo5 3b35996
avoid using unsafe.Pointer() when working with syscall.Utsname{}
mvo5 02a6d3f
Use /var/lib/snapd/bpf/*.{src,bin} for the seccomp profiles
mvo5
Jump to file or symbol
Failed to load files and symbols.
57
arch/arch.go
| @@ -22,6 +22,7 @@ package arch | ||
| import ( | ||
| "log" | ||
| "runtime" | ||
| + "syscall" | ||
| ) | ||
| // ArchitectureType is the type for a supported snappy architecture | ||
| @@ -38,6 +39,9 @@ func SetArchitecture(newArch ArchitectureType) { | ||
| arch = newArch | ||
| } | ||
| +// FIXME: rename all Ubuntu*Architecture() to SnapdArchitecture() | ||
| +// (or DpkgArchitecture) | ||
| + | ||
| // UbuntuArchitecture returns the debian equivalent architecture for the | ||
| // currently running architecture. | ||
| // | ||
| @@ -62,11 +66,62 @@ func ubuntuArchFromGoArch(goarch string) string { | ||
| "ppc64le": "ppc64el", | ||
| "s390x": "s390x", | ||
| "ppc": "powerpc", | ||
| + // available in debian and other distros | ||
| + "ppc64": "ppc64", | ||
|
|
||
| } | ||
| ubuntuArch := goArchMapping[goarch] | ||
| if ubuntuArch == "" { | ||
| - log.Panicf("unknown goarch %v", goarch) | ||
| + log.Panicf("unknown goarch %q", goarch) | ||
| + } | ||
| + | ||
| + return ubuntuArch | ||
| +} | ||
| + | ||
| +// UbuntuKernelArchitecture return the debian equivalent architecture | ||
| +// for the current running kernel. This is usually the same as the | ||
| +// UbuntuArchitecture - however there maybe cases that you run e.g. | ||
| +// a snapd:i386 on an amd64 kernel. | ||
| +func UbuntuKernelArchitecture() string { | ||
| + var utsname syscall.Utsname | ||
| + if err := syscall.Uname(&utsname); err != nil { | ||
| + log.Panicf("cannot get kernel architecture: %v", err) | ||
| + } | ||
| + | ||
| + // syscall.Utsname{} is using [65]int8 for all char[] inside it, | ||
| + // this makes converting it so awkward. The alternative would be | ||
| + // to use a unsafe.Pointer() to cast it to a [65]byte slice. | ||
| + // see https://github.com/golang/go/issues/20753 | ||
| + kernelArch := make([]byte, 0, len(utsname.Machine)) | ||
| + for _, c := range utsname.Machine { | ||
| + if c == 0 { | ||
| + break | ||
| + } | ||
| + kernelArch = append(kernelArch, byte(c)) | ||
| + } | ||
| + | ||
| + return ubuntuArchFromKernelArch(string(kernelArch)) | ||
| +} | ||
| + | ||
| +// ubuntuArchFromkernelArch maps the kernel architecture as reported | ||
| +// via uname() to the dpkg architecture | ||
| +func ubuntuArchFromKernelArch(utsMachine string) string { | ||
| + kernelArchMapping := map[string]string{ | ||
| + // kernel ubuntu | ||
| + "i686": "i386", | ||
| + "x86_64": "amd64", | ||
| + "armv7": "armhf", | ||
| + "aarch64": "arm64", | ||
| + "ppc64le": "ppc64el", | ||
| + "s390x": "s390x", | ||
| + "ppc": "powerpc", | ||
jdstrand
Contributor
|
||
| + // available in debian and other distros | ||
| + "ppc64": "ppc64", | ||
mvo5
Collaborator
|
||
| + } | ||
| + | ||
| + ubuntuArch := kernelArchMapping[utsMachine] | ||
| + if ubuntuArch == "" { | ||
| + log.Panicf("unknown kernel arch %q", utsMachine) | ||
| } | ||
| return ubuntuArch | ||
Oops, something went wrong.
I just noticed that arch_test.go is missing s390x and ppc64.