test (9b283d75) · Commits · tuxist / containerd

src/containerctl.cpp

+8 −0

Changes for src/containerctl.cpp: 8 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -51,6 +51,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		#include <sstream>
		#include <string>
		#include <fcntl.h>
		#include <linux/capability.h>
		#include <sched.h>
		#include <sys/prctl.h>
		#include <sys/wait.h>
		@@ -60,6 +61,8 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		#include <containerd/api.h>
		#include <sysbus/client.h>

		#include "seccomp.h"

		namespace {

		using Fields = std::vector<std::pair<std::string, std::string>>;
		@@ -187,6 +190,11 @@ int shell(const std::string &name, int argc, char **argv, int from) {
		}
		for (int c = 0; c < 64; ++c)
		if (!(bnd & (1ULL << c)) && prctl(PR_CAPBSET_DROP, c, 0, 0, 0) != 0 && errno == EINVAL) break;
		// and the container's kernel log filter: it isn't inherited through setns
		if (!(bnd & (1ULL << CAP_SYSLOG)) && !containerd::blockKernelLog()) {
		std::cerr << "containerctl: seccomp: " << strerror(errno) << std::endl;
		return 1;
		}

		// the PID namespace takes effect for children
		signal(SIGINT, SIG_IGN);

src/runtime.cpp

+2 −41

Changes for src/runtime.cpp: 2 added lines, 41 removed lines.
Original line number	Diff line number	Diff line
		@@ -30,7 +30,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		#include <algorithm>
		#include <cerrno>
		#include <csignal>
		#include <cstddef>
		#include <cstdint>
		#include <cstdio>
		#include <cstring>
		@@ -43,11 +42,8 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		#include <net/if.h>
		#include <poll.h>
		#include <grp.h>
		#include <linux/audit.h>
		#include <linux/capability.h>
		#include <linux/ethtool.h>
		#include <linux/filter.h>
		#include <linux/seccomp.h>
		#include <linux/sockios.h>
		#include <sched.h>
		#include <sys/mount.h>
		@@ -64,6 +60,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		#include "devices.h"
		#include "dhcp.h"
		#include "netlink.h"
		#include "seccomp.h"
		#include "util.h"

		#ifndef SYS_pidfd_open
		@@ -341,44 +338,8 @@ struct Pid1 {
		for (int c = 0; c <= lastCap(); ++c)
		if (!keep.count(c) && prctl(PR_CAPBSET_DROP, c, 0, 0, 0) != 0 && errno != EINVAL)
		fail(sysErr("PR_CAPBSET_DROP", errno));
		if (!keep.count(capabilityNumber("SYSLOG"))) noKernelLog();
		}

		// the kernel log isn't namespaced, and the kernel lets CAP_SYS_ADMIN (a
		// booted OS keeps it) read it as well as CAP_SYSLOG: syslog(2) gives
		// EPERM unless Capability=SYSLOG -- as in Docker's seccomp profile;
		// /dev/kmsg, the other way, isn't in the container's /dev
		void noKernelLog() {
		#if defined(__x86_64__)
		const uint32_t arch = AUDIT_ARCH_X86_64;
		#elif defined(__aarch64__)
		const uint32_t arch = AUDIT_ARCH_AARCH64;
		#elif defined(__i386__)
		const uint32_t arch = AUDIT_ARCH_I386;
		#else
		return;
		#endif
		std::vector<sock_filter> f = {
		BPF_STMT(BPF_LD \| BPF_W \| BPF_ABS, offsetof(seccomp_data, arch)),
		#if defined(__x86_64__)
		// i386 programs: their syslog is 103 too
		BPF_JUMP(BPF_JMP \| BPF_JEQ \| BPF_K, AUDIT_ARCH_I386, 1, 0),
		#endif
		BPF_JUMP(BPF_JMP \| BPF_JEQ \| BPF_K, arch, 0, 3),
		BPF_STMT(BPF_LD \| BPF_W \| BPF_ABS, offsetof(seccomp_data, nr)),
		#if defined(__x86_64__)
		BPF_STMT(BPF_ALU \| BPF_AND \| BPF_K, ~0x40000000u), // x32
		#endif
		BPF_JUMP(BPF_JMP \| BPF_JEQ \| BPF_K, SYS_syslog, 0, 1),
		BPF_STMT(BPF_RET \| BPF_K, SECCOMP_RET_ERRNO \| EPERM),
		BPF_STMT(BPF_RET \| BPF_K, SECCOMP_RET_ALLOW),
		};
		#if defined(__x86_64__)
		f[2].jf = 4; // past the x32 mask too
		#endif
		sock_fprog prog{(unsigned short)f.size(), f.data()};
		// still root with every capability here: no PR_SET_NO_NEW_PRIVS needed
		if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0) != 0) fail(sysErr("seccomp", errno));
		if (!keep.count(capabilityNumber("SYSLOG")) && !blockKernelLog()) fail(sysErr("seccomp", errno));
		}

		// ---- the command ----

src/seccomp.h

0 → 100644

+79 −0

Changes for src/seccomp.h: 79 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		/*******************************************************************************
		Copyright (c) 2026, Jan Koester jan.koester@gmx.net
		All rights reserved.

		Redistribution and use in source and binary forms, with or without
		modification, are permitted provided that the following conditions are met:
		* Redistributions of source code must retain the above copyright
		notice, this list of conditions and the following disclaimer.
		* Redistributions in binary form must reproduce the above copyright
		notice, this list of conditions and the following disclaimer in the
		documentation and/or other materials provided with the distribution.
		* Neither the name of the <organization> nor the
		names of its contributors may be used to endorse or promote products
		derived from this software without specific prior written permission.

		THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
		ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
		WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
		DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
		DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
		(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
		LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
		ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
		SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		*******************************************************************************/

		/* syslog(2) gives EPERM: the kernel log isn't namespaced, and the kernel
		* lets CAP_SYS_ADMIN (a booted OS keeps it) read it as well as CAP_SYSLOG.
		* containerd sets it on a container's PID 1 unless Capability=SYSLOG, as
		* Docker's seccomp profile does; containerctl shell too, for what it
		* starts in there. /dev/kmsg, the other way, isn't in the container's /dev.
		* Needs CAP_SYS_ADMIN or PR_SET_NO_NEW_PRIVS; errno on failure. */

		#pragma once

		#include <cerrno>
		#include <cstddef>
		#include <cstdint>

		#include <linux/audit.h>
		#include <linux/filter.h>
		#include <linux/seccomp.h>
		#include <sys/prctl.h>
		#include <sys/syscall.h>

		namespace containerd {

		inline bool blockKernelLog() {
		#if defined(__x86_64__)
		const uint32_t arch = AUDIT_ARCH_X86_64;
		#elif defined(__aarch64__)
		const uint32_t arch = AUDIT_ARCH_AARCH64;
		#elif defined(__i386__)
		const uint32_t arch = AUDIT_ARCH_I386;
		#else
		return true;
		#endif
		sock_filter f[] = {
		BPF_STMT(BPF_LD \| BPF_W \| BPF_ABS, offsetof(seccomp_data, arch)),
		#if defined(__x86_64__)
		// i386 programs: their syslog is 103 too
		BPF_JUMP(BPF_JMP \| BPF_JEQ \| BPF_K, AUDIT_ARCH_I386, 1, 0),
		BPF_JUMP(BPF_JMP \| BPF_JEQ \| BPF_K, arch, 0, 4),
		BPF_STMT(BPF_LD \| BPF_W \| BPF_ABS, offsetof(seccomp_data, nr)),
		BPF_STMT(BPF_ALU \| BPF_AND \| BPF_K, ~0x40000000u), // x32
		#else
		BPF_JUMP(BPF_JMP \| BPF_JEQ \| BPF_K, arch, 0, 3),
		BPF_STMT(BPF_LD \| BPF_W \| BPF_ABS, offsetof(seccomp_data, nr)),
		#endif
		BPF_JUMP(BPF_JMP \| BPF_JEQ \| BPF_K, SYS_syslog, 0, 1),
		BPF_STMT(BPF_RET \| BPF_K, SECCOMP_RET_ERRNO \| EPERM),
		BPF_STMT(BPF_RET \| BPF_K, SECCOMP_RET_ALLOW),
		};
		sock_fprog prog{(unsigned short)(sizeof(f) / sizeof(f[0])), f};
		return prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0) == 0;
		}

		} // namespace containerd