New upstream release (7.5p1)

1 files changed, 70 insertions, 49 deletions

diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index 62c578d3c..3a1aedce7 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -73,19 +73,35 @@
 # define SECCOMP_FILTER_FAIL SECCOMP_RET_TRAP
 #endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
 
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+# define ARG_LO_OFFSET  0
+# define ARG_HI_OFFSET  sizeof(uint32_t)
+#elif __BYTE_ORDER == __BIG_ENDIAN
+# define ARG_LO_OFFSET  sizeof(uint32_t)
+# define ARG_HI_OFFSET  0
+#else
+#error "Unknown endianness"
+#endif
+
 /* Simple helpers to avoid manual errors (but larger BPF programs). */
 #define SC_DENY(_nr, _errno) \
-        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 1), \
+        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 1), \
         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO|(_errno))
 #define SC_ALLOW(_nr) \
-        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 1), \
+        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 1), \
         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 #define SC_ALLOW_ARG(_nr, _arg_nr, _arg_val) \
-        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 4), \
-        /* load first syscall argument */ \
+        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 6), \
+        /* load and test first syscall argument, low word */ \
         BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
-            offsetof(struct seccomp_data, args[(_arg_nr)])), \
-        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_arg_val), 0, 1), \
+            offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_LO_OFFSET), \
+        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, \
+            ((_arg_val) & 0xFFFFFFFF), 0, 3), \
+        /* load and test first syscall argument, high word */ \
+        BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
+            offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_HI_OFFSET), \
+        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, \
+            (((uint32_t)((uint64_t)(_arg_val) >> 32)) & 0xFFFFFFFF), 0, 1), \
         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), \
         /* reload syscall number; all rules expect it in accumulator */ \
         BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
@@ -104,117 +120,122 @@ static const struct sock_filter preauth_insns[] = {
 
         /* Syscalls to non-fatally deny */
 #ifdef __NR_lstat
-        SC_DENY(lstat, EACCES),
+        SC_DENY(__NR_lstat, EACCES),
 #endif
 #ifdef __NR_lstat64
-        SC_DENY(lstat64, EACCES),
+        SC_DENY(__NR_lstat64, EACCES),
 #endif
 #ifdef __NR_fstat
-        SC_DENY(fstat, EACCES),
+        SC_DENY(__NR_fstat, EACCES),
 #endif
 #ifdef __NR_fstat64
-        SC_DENY(fstat64, EACCES),
+        SC_DENY(__NR_fstat64, EACCES),
 #endif
 #ifdef __NR_open
-        SC_DENY(open, EACCES),
+        SC_DENY(__NR_open, EACCES),
 #endif
 #ifdef __NR_openat
-        SC_DENY(openat, EACCES),
+        SC_DENY(__NR_openat, EACCES),
 #endif
 #ifdef __NR_newfstatat
-        SC_DENY(newfstatat, EACCES),
+        SC_DENY(__NR_newfstatat, EACCES),
 #endif
 #ifdef __NR_stat
-        SC_DENY(stat, EACCES),
+        SC_DENY(__NR_stat, EACCES),
 #endif
 #ifdef __NR_stat64
-        SC_DENY(stat64, EACCES),
+        SC_DENY(__NR_stat64, EACCES),
 #endif
 
         /* Syscalls to permit */
 #ifdef __NR_brk
-        SC_ALLOW(brk),
+        SC_ALLOW(__NR_brk),
 #endif
 #ifdef __NR_clock_gettime
-        SC_ALLOW(clock_gettime),
-# if defined(__x86_64__) && defined(__ILP32__)
-        /* On Linux x32, the clock_gettime VDSO currently falls back to the
-         * x86-64 syscall (see https://bugs.debian.org/849923), so allow
-         * that too.
-         */
-        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K,
-            __NR_clock_gettime & ~__X32_SYSCALL_BIT, 0, 1),
-        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-# endif
+        SC_ALLOW(__NR_clock_gettime),
 #endif
 #ifdef __NR_close
-        SC_ALLOW(close),
+        SC_ALLOW(__NR_close),
 #endif
 #ifdef __NR_exit
-        SC_ALLOW(exit),
+        SC_ALLOW(__NR_exit),
 #endif
 #ifdef __NR_exit_group
-        SC_ALLOW(exit_group),
+        SC_ALLOW(__NR_exit_group),
 #endif
 #ifdef __NR_getpgid
-        SC_ALLOW(getpgid),
+        SC_ALLOW(__NR_getpgid),
 #endif
 #ifdef __NR_getpid
-        SC_ALLOW(getpid),
+        SC_ALLOW(__NR_getpid),
 #endif
 #ifdef __NR_getrandom
-        SC_ALLOW(getrandom),
+        SC_ALLOW(__NR_getrandom),
 #endif
 #ifdef __NR_gettimeofday
-        SC_ALLOW(gettimeofday),
+        SC_ALLOW(__NR_gettimeofday),
 #endif
 #ifdef __NR_madvise
-        SC_ALLOW(madvise),
+        SC_ALLOW(__NR_madvise),
 #endif
 #ifdef __NR_mmap
-        SC_ALLOW(mmap),
+        SC_ALLOW(__NR_mmap),
 #endif
 #ifdef __NR_mmap2
-        SC_ALLOW(mmap2),
+        SC_ALLOW(__NR_mmap2),
 #endif
 #ifdef __NR_mremap
-        SC_ALLOW(mremap),
+        SC_ALLOW(__NR_mremap),
 #endif
 #ifdef __NR_munmap
-        SC_ALLOW(munmap),
+        SC_ALLOW(__NR_munmap),
 #endif
 #ifdef __NR__newselect
-        SC_ALLOW(_newselect),
+        SC_ALLOW(__NR__newselect),
 #endif
 #ifdef __NR_poll
-        SC_ALLOW(poll),
+        SC_ALLOW(__NR_poll),
 #endif
 #ifdef __NR_pselect6
-        SC_ALLOW(pselect6),
+        SC_ALLOW(__NR_pselect6),
 #endif
 #ifdef __NR_read
-        SC_ALLOW(read),
+        SC_ALLOW(__NR_read),
 #endif
 #ifdef __NR_rt_sigprocmask
-        SC_ALLOW(rt_sigprocmask),
+        SC_ALLOW(__NR_rt_sigprocmask),
 #endif
 #ifdef __NR_select
-        SC_ALLOW(select),
+        SC_ALLOW(__NR_select),
 #endif
 #ifdef __NR_shutdown
-        SC_ALLOW(shutdown),
+        SC_ALLOW(__NR_shutdown),
 #endif
 #ifdef __NR_sigprocmask
-        SC_ALLOW(sigprocmask),
+        SC_ALLOW(__NR_sigprocmask),
 #endif
 #ifdef __NR_time
-        SC_ALLOW(time),
+        SC_ALLOW(__NR_time),
 #endif
 #ifdef __NR_write
-        SC_ALLOW(write),
+        SC_ALLOW(__NR_write),
 #endif
 #ifdef __NR_socketcall
-        SC_ALLOW_ARG(socketcall, 0, SYS_SHUTDOWN),
+        SC_ALLOW_ARG(__NR_socketcall, 0, SYS_SHUTDOWN),
+#endif
+#if defined(__NR_ioctl) && defined(__s390__)
+        /* Allow ioctls for ICA crypto card on s390 */
+        SC_ALLOW_ARG(__NR_ioctl, 1, Z90STAT_STATUS_MASK),
+        SC_ALLOW_ARG(__NR_ioctl, 1, ICARSAMODEXPO),
+        SC_ALLOW_ARG(__NR_ioctl, 1, ICARSACRT),
+#endif
+#if defined(__x86_64__) && defined(__ILP32__) && defined(__X32_SYSCALL_BIT)
+        /*
+         * On Linux x32, the clock_gettime VDSO falls back to the
+         * x86-64 syscall under some circumstances, e.g.
+         * https://bugs.debian.org/849923
+         */
+        SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT);
 #endif
 
         /* Default deny */