* Jann Horn: > +seccomp maintainers/reviewers > [thread context is at > https://lore.kernel.org/linux-api/87lfer2c0b....@oldenburg2.str.redhat.com/ > ] > > On Tue, Nov 24, 2020 at 5:49 PM Christoph Hellwig <h...@infradead.org> wrote: >> On Tue, Nov 24, 2020 at 03:08:05PM +0100, Mark Wielaard wrote: >> > For valgrind the issue is statx which we try to use before falling back >> > to stat64, fstatat or stat (depending on architecture, not all define >> > all of these). The problem with these fallbacks is that under some >> > containers (libseccomp versions) they might return EPERM instead of >> > ENOSYS. This causes really obscure errors that are really hard to >> > diagnose. >> >> So find a way to detect these completely broken container run times >> and refuse to run under them at all. After all they've decided to >> deliberately break the syscall ABI. (and yes, we gave the the rope >> to do that with seccomp :(). > > FWIW, if the consensus is that seccomp filters that return -EPERM by > default are categorically wrong, I think it should be fairly easy to > add a check to the seccomp core that detects whether the installed > filter returns EPERM for some fixed unused syscall number and, if so, > prints a warning to dmesg or something along those lines...
But that's playing Core Wars, right? Someone will write a seccomp filter trying to game that kernel check. I don't really think it solves anything until there is consensus what a system call filter should do with system calls not on the permitted list. Thanks, Florian -- Red Hat GmbH, https://de.redhat.com/ , Registered seat: Grasbrunn, Commercial register: Amtsgericht Muenchen, HRB 153243, Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill
