MIRRORS/meta-virtualization
1
0
Fork 0
mirror of git://git.yoctoproject.org/meta-virtualization.git synced 2025-07-19 20:59:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

lxc: Enable seccomp support for lxc

Browse Source 
Enabled seccomp support for lxc.
Also added a patch to enable seccomp.profile only when compiled with
libseccomp. Currently, seccomp.profile is silently ignored. This
could lead to the false impression that the seccomp filter is
applied while it actually isn't.

Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
This commit is contained in:
sana kazi 2021-09-04 21:24:08 +05:30 committed by Bruce Ashfield
parent 5e108f4598
commit 88a8ccb980
2 changed files with 48 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
recipes-containers/lxc/files/enable_seccomp_profile_when_compiled_libseccomp.patch Normal file
View File

@ -0,0 +1,46 @@
From 3d46e1d1f8e904fddd4fab3e8d0c6cf57d2ddd4e Mon Sep 17 00:00:00 2001
From: Maximilian Blenk <Maximilian.Blenk@bmw.de>
Date: Mon, 23 Aug 2021 22:04:40 +0200
Subject: [PATCH] config: enable seccomp profile only when compiled with
libseccomp
Make lxc fail if seccomp.profile is specified but lxc is compiled
without seccomp support. Currently, seccomp.profile is silently ignored
if is specified in such a scenario. This could lead to the false
impression that the seccomp filter is applied while it actually isn't.
Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>
---
src/lxc/confile.c | 8 ++++++++
1 file changed, 8 insertions(+)
Upstream-Status: Submitted [https://github.com/lxc/lxc/pull/3947/commits/3d46e1d1f8e904fddd4fab3e8d0c6cf57d2ddd4e]
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index d8b96c6921..1cc8da15f1 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -1211,7 +1211,11 @@ static int set_config_seccomp_notify_proxy(const char *key, const char *value,
static int set_config_seccomp_profile(const char *key, const char *value,
struct lxc_conf *lxc_conf, void *data)
{
+#ifdef HAVE_SECCOMP
return set_config_path_item(&lxc_conf->seccomp.seccomp, value);
+#else
+ return ret_set_errno(-1, ENOSYS);
+#endif
}
static int set_config_execute_cmd(const char *key, const char *value,
@@ -4383,7 +4387,11 @@ static int get_config_seccomp_notify_proxy(const char *key, char *retv, int inle
static int get_config_seccomp_profile(const char *key, char *retv, int inlen,
struct lxc_conf *c, void *data)
{
+#ifdef HAVE_SECCOMP
return lxc_get_conf_str(retv, inlen, c->seccomp.seccomp);
+#else
+ return ret_errno(ENOSYS);
+#endif
}
static int get_config_autodev(const char *key, char *retv, int inlen,

2
recipes-containers/lxc/lxc_4.0.9.bb
View File

@ -49,6 +49,7 @@ SRC_URI = "http://linuxcontainers.org/downloads/${BPN}/${BPN}-${PV}.tar.gz \
file://tests-add-no-validate-when-using-download-template.patch \
file://dnsmasq.conf \
file://lxc-net \
file://enable_seccomp_profile_when_compiled_libseccomp.patch \
"
SRC_URI[md5sum] = "365fcca985038910e19a1e0fff15ed07"
@ -72,6 +73,7 @@ EXTRA_OECONF += "--enable-log-src-basename --disable-werror"
PACKAGECONFIG ??= "templates \
${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', '', d)} \
${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux', '', d)} \
${@bb.utils.contains('DISTRO_FEATURES', 'seccomp', 'seccomp', '', d)} \
"
PACKAGECONFIG[doc] = "--enable-doc --enable-api-docs,--disable-doc --disable-api-docs,,"
PACKAGECONFIG[rpath] = "--enable-rpath,--disable-rpath,,"