[chrony-dev] [PATCH v2] sys_linux: allow rseq in seccomp filter

[christian.ehrhardt@xxxxxxxxxxxxx]

From: Michael Hudson-Doyle <michael.hudson@xxxxxxxxxxxxx>

Libc 2.35 will use rseq syscalls [1][2] by default and thereby
break chrony in seccomp isolation.

Update in v2:
 - fixed link references

[1]: https://www.efficios.com/blog/2019/02/08/linux-restartable-sequences/
[2]: https://sourceware.org/pipermail/libc-alpha/2022-February/136040.html

Tested-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx>
Reviewed-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx>
Signed-off-by: Michael Hudson-Doyle <michael.hudson@xxxxxxxxxxxxx>
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx>
---
 sys_linux.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sys_linux.c b/sys_linux.c
index 9cab2efa..1b9ba5f8 100644
--- a/sys_linux.c
+++ b/sys_linux.c
@@ -601,6 +601,9 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
     SCMP_SYS(getrandom),
     SCMP_SYS(sysinfo),
     SCMP_SYS(uname),
+#ifdef __NR_rseq
+    SCMP_SYS(rseq),
+#endif
   };
 
   const int denied_any[] = {
-- 
2.35.0


-- 
To unsubscribe email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "unsubscribe" in the subject.
For help email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "help" in the subject.
Trouble?  Email listmaster@xxxxxxxxxxxxxxxxxxxx.