Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Patch for 2.53.2 #45

Open
wants to merge 2 commits into
base: origin-2.53.2-1733220372
Choose a base branch
from
Open

Patch for 2.53.2 #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
59aa621
commit patch 15595340
Dec 3, 2024
c9aa233
commit patch 15595341
Dec 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion cmd/snap-seccomp-blacklist/snap-seccomp-blacklist.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ static int populate_filter(scmp_filter_ctx ctx, const uint32_t *arch_tags, size_
* NOTE: not using scmp_rule_add_exact as that was not doing anything
* at all (presumably due to having all the architectures defined). */

const struct scmp_arg_cmp no_tty_inject = {
struct scmp_arg_cmp no_tty_inject = {
/* We learned that existing programs make legitimate requests with all
* bits set in the more significant 32bit word of the 64 bit double
* word. While this kernel behavior remains suspect and presumably
Expand All @@ -122,6 +122,10 @@ static int populate_filter(scmp_filter_ctx ctx, const uint32_t *arch_tags, size_
};
sc_err = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), sys_ioctl_nr, 1, no_tty_inject);

/* also block use of TIOCLINUX */
no_tty_inject.datum_b = TIOCLINUX;
sc_err = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), sys_ioctl_nr, 1, no_tty_inject);

if (sc_err < 0) {
showerr("cannot add rule preventing the use high bits in ioctl");
return sc_err;
Expand Down
6 changes: 6 additions & 0 deletions interfaces/seccomp/template.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,7 +198,13 @@ inotify_rm_watch
# input (man tty_ioctl), so we disallow it to prevent snaps plugging interfaces
# with 'capability sys_admin' from interfering with other snaps or the
# unconfined user's terminal.
# similarly, TIOCLINUX allows to fake input as well (man ioctl_console) so
# disallow that too
# TODO: this should be scaled back even more
~ioctl - TIOCSTI
~ioctl - TIOCLINUX
# restrict argument otherwise will match all uses of ioctl() and allow the rules
# that were disallowed above - TODO: why does this still restrict TIOCLINUX?
ioctl - !TIOCSTI

io_cancel
Expand Down
Loading
Loading