Allow killing process rather than thread with seccomp

[bobrik]

Is your feature request related to a problem? Please describe.

I'm frustrated when programs make syscalls they should not.

I've tried using SystemCallFilter with a Go program and seccomp killed a thread silently, blackholing some part of the program, but otherwise keeping it running: golang/go#30753.

Describe the solution you'd like

I want to be able to kill whole process rather than thread. Currently SCMP_ACT_KILL is used:

• systemd/src/core/execute.c

  Line 1441 in 4cea310

  negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);

Seccomp also allows SCMP_ACT_KILL_PROCESS:

• http://man7.org/linux/man-pages/man3/seccomp_init.3.html

       SCMP_ACT_KILL_PROCESS
              The entire process will be terminated by the kernel with
              SIGSYS when it calls a syscall that does not match any of the
              configured seccomp filter rules.

It seems like SCMP_ACT_TRAP and SCMP_ACT_LOG may be useful as well.

[bobrik]

It may be reasonable to switch to SCMP_ACT_KILL_PROCESS by default as well.

[dqminh]

Looking at this, one workaround is to set SystemCallErrorNumber=EPERM which doesnt terminate the thread but instead returning EPERM, which should be more user-friendly than killing the thread without a catchable signal.

I'm also not sure that SCMP_ACT_KILL is a suitable default. That seems like it will be very non-obvious for a lot of programs ( golang for example where it expect a catchable SIGSYS in order to panic properly ). What do we think about making SCMP_ACT_ERRNO(EPERM) the default, and have another knob to customize the seccomp action. SystemCallErrorAction=allow|trap|kill|trace|errno|log(for new kernel ) ?

cc @poettering

[poettering]

We really should never use SCMP_ACT_KILL at all. Sounds like a historic mistake, and we should ust change that. killing individual threads is never OK, it should always be the full thing.

I think it would be great if we could have a new option SystemCallFiltreLog= or so which takes a boolean and allows logging of the syscalls independently of denying/allowing them.

[poettering]

hmm, on my system SCMP_ACT_KILL_PROCESS doesn't exist yet, unfortunately :-(

Kernel support was added in 0466bdb99e8744bc9befa8d62a317f0fd7fd7421(Aug 2017), but my libseccomp version still doesn't have it (f29)...

I figure we should change our logic to pick SCMP_ACT_KILL_PROCESS dynamically if libseccomp and kernel support it, and otherwise continue to use SCMP_ACT_KILL even if it sucks for threaded apps...

[bobrik]

Commit adding support for SCMP_ACT_KILL_PROCESS in libseccomp:

• seccomp/libseccomp@b2f15f3

It's not in any released version yet.

[poettering]

Hmm, I guess we have to wait until they release a version...

[bobrik]

Good point, I asked for a release: seccomp/libseccomp#145

[poettering]

Moving to to v243 milestone, since libseccomp doesn't expose this yet.

[poettering]

Fix waiting in #12430