bool do_resolve_add_rule(uint32_t arch, char *line, scmp_filter_ctx ctx,
uint32_t action)
{
int nr, ret;
ret = seccomp_arch_exist(ctx, arch);
if (arch && ret != 0) {
ERROR("BUG: Seccomp: rule and context arch do not match (arch "
"%d): %s.",
arch, strerror(-ret));
return false;
}
if (strncmp(line, "reject_force_umount", 19) == 0) {
INFO("Setting Seccomp rule to reject force umounts.");
ret = seccomp_rule_add_exact(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(umount2),
1, SCMP_A1(SCMP_CMP_MASKED_EQ , MNT_FORCE , MNT_FORCE ));
if (ret < 0) {
ERROR("Failed (%d) loading rule to reject force "
"umount: %s.",
ret, strerror(-ret));
return false;
}
return true;
}
nr = seccomp_syscall_resolve_name(line);
if (nr == __NR_SCMP_ERROR) {
WARN("Seccomp: failed to resolve syscall: %s.", line);
WARN("This syscall will NOT be blacklisted.");
return true;
}
if (nr < 0) {
WARN("Seccomp: got negative for syscall: %d: %s.", nr, line);
WARN("This syscall will NOT be blacklisted.");
return true;
}
ret = seccomp_rule_add_exact(ctx, action, nr, 0);
if (ret < 0) {
ERROR("Failed (%d) loading rule for %s (nr %d action %d): %s.",
ret, line, nr, action, strerror(-ret));
return false;
}
return true;
}
static void sc_add_seccomp_archs(scmp_filter_ctx * ctx)
{
uint32_t native_arch = seccomp_arch_native(); // seccomp userspace
uint32_t host_arch = get_hostarch(); // kernel
uint32_t compat_arch = 0;
debug("host arch (kernel) is '%d'", host_arch);
debug("native arch (userspace) is '%d'", native_arch);
// For architectures that support a compat architecture, when the
// kernel and userspace match, add the compat arch, otherwise add
// the kernel arch to support the kernel's arch (eg, 64bit kernels with
// 32bit userspace).
if (host_arch == native_arch) {
switch (host_arch) {
#if defined (SCMP_ARCH_X86_64)
case SCMP_ARCH_X86_64:
compat_arch = SCMP_ARCH_X86;
break;
#endif
#if defined(SCMP_ARCH_AARCH64)
case SCMP_ARCH_AARCH64:
compat_arch = SCMP_ARCH_ARM;
break;
#endif
#if defined (SCMP_ARCH_PPC64)
case SCMP_ARCH_PPC64:
compat_arch = SCMP_ARCH_PPC;
break;
#endif
default:
break;
}
} else
compat_arch = host_arch;
if (compat_arch > 0 && seccomp_arch_exist(ctx, compat_arch) == -EEXIST) {
debug("adding compat arch '%d'", compat_arch);
if (seccomp_arch_add(ctx, compat_arch) < 0)
die("seccomp_arch_add(..., compat_arch) failed");
}
}
