jail/seccomp: complete the pre-main syscall allowlists - #49
Merged
Merged
Conversation
The loader and pre-main allowlists name the syscalls a 64-bit libc issues before the workload reaches its entry point. A 32-bit libc sets its thread pointer with set_tls on ARM and set_thread_area on MIPS and i386, and maps and inspects its objects with mmap2, fstat64, fstatat64, statx, fcntl64 and the 64-suffixed statfs calls; glibc and bionic also read the stack limit with ugetrlimit or getrlimit there. None of these are in the lists, so the first syscall of ld.so already hits the profile's default action and a SCMP_ACT_KILL_PROCESS profile kills the jailed process before the entry breakpoint, which is how umdns dies on every 32-bit target. A static glibc binary further resolves its origin in _dl_non_dynamic_init(), reading the /proc/self/exe link with readlinkat before main, which the static pre-main list omits as well. Add the names to the lists so the grants and the deltas that revoke them stay in step; find_syscall() skips a name the target does not have. Fixes: f15d0c4 ("jail: apply OCI seccomp filters via ptrace syscall injection") Fixes: openwrt/openwrt#25392 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This was referenced Sep 25, 2026
|
Supersedes #47 so I'll close that. I should be able to test at least on |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The ptrace seccomp injection added in f15d0c4 arms a phase-1 filter at the post-execve stop, before ld.so runs, made of the profile plus a fixed allowlist of the syscalls a libc issues before the workload reaches its entry point and main. That allowlist only names the 64-bit syscalls. A 32-bit libc sets its thread pointer with
set_tlson ARM andset_thread_areaon MIPS and i386, and maps and inspects its objects withmmap2,fstat64,fstatat64,statx,fcntl64and the 64-suffixed statfs calls; glibc and bionic also read the stack limit withugetrlimitorgetrlimitthere. The first syscall of ld.so therefore hits the profile's default action, and aSCMP_ACT_KILL_PROCESSprofile kills the jailed process before the entry breakpoint. This is how umdns dies on every 32-bit target since the 2026-09-13 procd bump, see openwrt/openwrt#25392. A static glibc binary further resolves its origin in_dl_non_dynamic_init()withreadlinkaton /proc/self/exe before main, which the static pre-main list omitted as well.The allowlists now carry the 32-bit names and
readlinkatfor the static pre-main phase. The grants and the deltas that revoke them at the entry and main boundaries are kept in step, so the filter in force once main runs is still exactly the profile.find_syscall()skips a name the target does not have, so one list serves every architecture.Evidence: musl 1.2.6
__dls2b->__init_tp()->__set_thread_area()(raw 0xf0005 on ARM,SYS_set_thread_areaelsewhere) and the 32-bit remaps insrc/internal/syscall.h; a qemu-mips syscall trace of a musl binary from the mips_24kc staging root; a host strace of a-m32glibc binary (set_thread_area, mmap2, statx, ugetrlimit before main); glibc 2.43sysdeps/unix/sysv/linux/arm/tls.h(set_tls),sysdeps/mips/nptl/tls.handsysdeps/i386/nptl/tls.h(set_thread_area); bioniclibc/SYSCALLS.TXT(__ARM_NR_set_tls, set_thread_area, ugetrlimit, lp32 statfs64/fstatfs64); a static glibc test program with a getpid marker in main showing readlinkat before it on x86_64 and i386. The change is compile-checked for x86_64; a runtime test on a 32-bit target is still outstanding.