From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 1D855139898 for ; Mon, 24 Aug 2015 21:22:14 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 91E9F14220; Mon, 24 Aug 2015 21:22:11 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 0785914220 for ; Mon, 24 Aug 2015 21:22:10 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 2DEA63406A7 for ; Mon, 24 Aug 2015 21:22:10 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id BE099171 for ; Mon, 24 Aug 2015 21:22:08 +0000 (UTC) From: "Mike Frysinger" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Frysinger" Message-ID: <1440451259.bcb6683c56d9646e12881a6b59bc740e6004e663.vapier@gentoo> Subject: [gentoo-commits] proj/pax-utils:master commit in: / X-VCS-Repository: proj/pax-utils X-VCS-Files: porting.h security.c X-VCS-Directories: / X-VCS-Committer: vapier X-VCS-Committer-Name: Mike Frysinger X-VCS-Revision: bcb6683c56d9646e12881a6b59bc740e6004e663 X-VCS-Branch: master Date: Mon, 24 Aug 2015 21:22:08 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: ff28b575-d743-4e74-a08d-e629efb1547b X-Archives-Hash: a73d11410872f881acc7b4d58af399bc commit: bcb6683c56d9646e12881a6b59bc740e6004e663 Author: Mike Frysinger gentoo org> AuthorDate: Mon Aug 24 21:20:21 2015 +0000 Commit: Mike Frysinger gentoo org> CommitDate: Mon Aug 24 21:20:59 2015 +0000 URL: https://gitweb.gentoo.org/proj/pax-utils.git/commit/?id=bcb6683c security: add a debug handler for seccomp If a bad syscall is hit, it can be hard to track down. Add a debug mode that people can enable to get useful error messages showing the failure. URL: https://bugs.gentoo.org/558482 porting.h | 3 +++ security.c | 27 ++++++++++++++++++++++++++- 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/porting.h b/porting.h index c93f0f8..1107b4e 100644 --- a/porting.h +++ b/porting.h @@ -30,6 +30,7 @@ #include #include #include +#include #include #include #include @@ -217,4 +218,6 @@ # define O_CLOEXEC 0 #endif +#define __unused__ __attribute__((__unused__)) + #endif /* _PORTING_H */ diff --git a/security.c b/security.c index ccecb90..a62c798 100644 --- a/security.c +++ b/security.c @@ -41,6 +41,28 @@ static int pax_seccomp_rules_add(scmp_filter_ctx ctx, int syscalls[], size_t num } #define pax_seccomp_rules_add(ctx, syscalls) pax_seccomp_rules_add(ctx, syscalls, ARRAY_SIZE(syscalls)) +static void +pax_seccomp_sigal(__unused__ int signo, siginfo_t *info, __unused__ void *context) +{ + warn("seccomp violated: syscall %i", info->si_syscall); + fflush(stderr); +#ifdef si_syscall + warn(" syscall = %s", + seccomp_syscall_resolve_num_arch(seccomp_arch_native(), info->si_syscall)); +#endif + kill(getpid(), SIGSYS); + _exit(1); +} + +static void pax_seccomp_signal_init(void) +{ + struct sigaction act; + sigemptyset(&act.sa_mask); + act.sa_sigaction = pax_seccomp_sigal, + act.sa_flags = SA_SIGINFO | SA_RESETHAND; + sigaction(SIGSYS, &act, NULL); +} + static void pax_seccomp_init(bool allow_forking) { /* Order determines priority (first == lowest prio). */ @@ -113,7 +135,7 @@ static void pax_seccomp_init(bool allow_forking) SCMP_SYS(waitid), SCMP_SYS(waitpid), }; - scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_TRAP); + scmp_filter_ctx ctx = seccomp_init(USE_DEBUG ? SCMP_ACT_TRAP : SCMP_ACT_KILL); if (!ctx) { warnp("seccomp_init failed"); return; @@ -129,6 +151,9 @@ static void pax_seccomp_init(bool allow_forking) /* We already called prctl. */ seccomp_attr_set(ctx, SCMP_FLTATR_CTL_NNP, 0); + if (USE_DEBUG) + pax_seccomp_signal_init(); + #ifndef __SANITIZE_ADDRESS__ /* ASAN does some weird stuff. */ if (seccomp_load(ctx) < 0)