faraphel/chrony
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sys_linux: allow rseq in seccomp filter

Browse source 
Libc 2.35 will use rseq syscalls [1][2] by default and thereby
break chrony in seccomp isolation.

[1]: https://www.efficios.com/blog/2019/02/08/linux-restartable-sequences/
[2]: https://sourceware.org/pipermail/libc-alpha/2022-February/136040.html

Tested-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Reviewed-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Signed-off-by: Michael Hudson-Doyle <michael.hudson@canonical.com>
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
This commit is contained in:
Michael Hudson-Doyle 2022-02-09 09:06:13 +01:00 committed by Miroslav Lichvar
parent e55f174bd3
commit 8bb8f15a7d
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
sys_linux.c
View file

@ -497,6 +497,9 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
SCMP_SYS(getrlimit), SCMP_SYS(getrlimit),
SCMP_SYS(getuid), SCMP_SYS(getuid),
SCMP_SYS(getuid32), SCMP_SYS(getuid32),
#ifdef __NR_rseq
SCMP_SYS(rseq),
#endif
SCMP_SYS(rt_sigaction), SCMP_SYS(rt_sigaction),
SCMP_SYS(rt_sigreturn), SCMP_SYS(rt_sigreturn),
SCMP_SYS(rt_sigprocmask), SCMP_SYS(rt_sigprocmask),