seccomp: fix multiplexed system calls
authorChristian Ehrhardt <christian.ehrhardt@canonical.com>
Wed, 27 Nov 2019 08:52:07 +0000 (09:52 +0100)
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Sun, 15 Dec 2019 10:26:45 +0000 (11:26 +0100)
commit2c6568221a4c73aaea8f00690dbab662f4966d09
treec0fe5dfc65e055b772a6c4486b354285dbd2cd7c
parentbcf0aa02bf68cfd8b55ecaa5221a246a63a9646f
seccomp: fix multiplexed system calls

Since libseccomp 2.4.2 more architectures have shmat handled as multiplexed
call. Those will fail to be added due to seccomp_rule_add_exact failing
on them since they'd need to add multiple rules [1].
See the discussion at https://github.com/seccomp/libseccomp/issues/193

After discussions about the options rejected [2][3] the initial thought of
a fallback to the non '_exact' version of the seccomp rule adding the next
option is to handle those now affected (i386, s390, s390x) the same way as
ppc which ignores and does not block shmat.

[1]: https://github.com/seccomp/libseccomp/issues/193
[2]: https://github.com/systemd/systemd/pull/14167#issuecomment-559136906
[3]: https://github.com/systemd/systemd/commit/469830d1

(cherry picked from commit bed4668d1daeb640c1d55e79e6a1725c81118e39)
src/shared/seccomp-util.c