add @filesystem and @filesystem-ops syscall filter groups #4537
Conversation
|
"@resources" looks good. I don't like the split into "basic" and "advanced" — it's just too arbitrary. (The names "@filesystem" and "@filesystem-ops" also don't really explain the difference). I'd prefer to add new groups "@filesystem-read" and "@filesystem-write", even if if requires looking the arguments of some system calls, not just at the syscall number. @filesystemd-read should include the calls that don't modify the file system, and @filesystem-write the ones that do or may modify. The tricky syscalls would be This PR needs rebasing after my |
poettering
force-pushed
the
seccomp-filesystem
branch
from
7aee02a
to
02f84c6
Compare
|
OK, I force pushed a new rebased version of this. I merged the two groups into one now: "@filesystem" that is hopefully more acceptable? I am not sure we could properly distuingish read/write access with seccomp for all cases really. And if we can I am not sure this belongs under SystemCallFilters= (which really just matches system calls so far, but doesn't try to grok semantics of a call), but probably should get its own call ReadOnlyFileAccess=yes|no or so... ("@resources" already got merged btw, as part of the original PR.) |
@filesystem groups various file system operations, such as opening files and directories for read/write and stat()ing them, plus renaming, deleting, symlinking, hardlinking.
poettering
force-pushed
the
seccomp-filesystem
branch
from
02f84c6
to
fffa60c
Compare
|
Yeah, let's merge this. If we ever decide to make this more fancy, we can add The failure is the one we have seen before, probably unrelated: |
|
And also |
|
Is it intentional that the group includes |
We added mmap() and mmap2(), but forgot munmap(). Fix that. Pointed out by @lucaswerkmeister: systemd#4537 (comment)
We added mmap() and mmap2(), but forgot munmap(). Fix that. Pointed out by @lucaswerkmeister: systemd#4537 (comment)
We added mmap() and mmap2(), but forgot munmap(). Fix that. Pointed out by @lucaswerkmeister: #4537 (comment)
After discussions in #4483, this is a new, separate PR now for the
@filesystemand@filesystem-opssyscall filter groups, as they need more discussion and should probably not be merged before v232 is out.This PR is on top of #4483, hence that PR should really be merged first, and until then please ignore all commits in this PR except the last one.
@keszybz, @topimiettinen, @evverx could you summarize your suggestions regarding these groups here again, please?