Default seccomp whitelist is insufficient on ARM #3629
Comments
|
+1 on this. I'm fairly new to rkts codebase, but I'll have a look, perhaps it's just extending an existing array. |
|
I think this should be whitelisted in @lucab Do you see any problems about this whitelist being extended per default, or do you think that this should be dynamically added when running on ARM? I would open a PR for this if you want. @Xenopathic Do you have any other reference about what syscalls are especially needed for ARM devices? |
I would expect these to be added only when running on matching architectures, as some of those syscalls don't exist on other arch (e.g. |
|
@Xenopathic I can not reproduce your issue: main.c: #include <stdio.h>
int main(){
printf("hello world\n");
return 0;
}Makefile: all: hello-static-armv7l.aci
hello.static.armv7l: main.c
arm-linux-gnueabihf-gcc -o hello.static.armv7l -static main.c
hello-static-armv7l.aci: hello.static.armv7l
bash build-aci.sh hello.static.armv7l armv7l static
clean:
-rm -f hello*build-aci.sh: #!/bin/bash
BIN=$1
ARCH=$2
TYPE=$3
acbuild --debug begin
# In the event of the script exiting, end the build
trap "{ export EXT=$?; acbuild --debug end && exit $EXT; }" EXIT
acbuild --debug set-name trusch.io/hello
acbuild --debug label add arch $ARCH
acbuild --debug copy $BIN /hello
acbuild --debug set-exec -- /hello
acbuild --debug write --overwrite hello-${TYPE}-${ARCH}.aci
gpg --sign --detach --armor --yes hello-${TYPE}-${ARCH}.aci
exit $?Environment: Output: Can you provide detailed information on how to reproduce this? |
|
Looks like your systemd is compiled without seccomp enforcement, which if you are using host flavour stage1 (or whatever stage1 you are using uses systemd with |
|
Ah ok, my fault. I only have some devices here, and no one with arch linux. I'll build a new systemd for my current testbed. |
This enables us to run binaries which use these syscalls when systemd has seccomp enforcing enabled. Like reported this should affect at least all gcc compiled binaries. This solves issue rkt#3629.
This enables us to run binaries which use these syscalls when systemd has seccomp enforcing enabled. Like reported this should affect at least all gcc compiled binaries. This solves issue rkt#3629.
This enables us to run binaries which use these syscalls when systemd has seccomp enforcing enabled. Like reported this should affect at least all gcc compiled binaries. This solves issue rkt#3629.
Environment
What did you do?
Attempt to run nearly any binary on an ARMv7l architecture through rkt. Oddly the Go "Hello World" binary works fine, but even a simple
int main() { return 0; }compiled statically with gcc hits this problem.What did you expect to see?
Successful execution of the executable.
What did you see instead?
Executable is killed with SIGSYS, due to calling an ARM-specific syscall that isn't whitelisted in the default seccomp profile.
The Docker seccomp profile includes support for ARM and AArch64 devices, it specifically whitelists these syscalls:
Running
straceon a simple ARM binary showsset_tlsis called, hence the SIGSYS under rkt.It would be great to see rkt working fully on ARM, I know it's not officially supported at the moment but I can hope 😄
The text was updated successfully, but these errors were encountered: