seccomp: fix multiplexed system calls
authorChristian Ehrhardt <christian.ehrhardt@canonical.com>
Wed, 27 Nov 2019 08:52:07 +0000 (09:52 +0100)
committerChristian Ehrhardt <christian.ehrhardt@canonical.com>
Thu, 5 Dec 2019 06:19:07 +0000 (07:19 +0100)
commitbed4668d1daeb640c1d55e79e6a1725c81118e39
tree98bf4995efad8695aa0b250d49af44480990dcac
parentda4dd97405eac3f692f7bd032983adc8b780c8b6
seccomp: fix multiplexed system calls

Since libseccomp 2.4.2 more architectures have shmat handled as multiplexed
call. Those will fail to be added due to seccomp_rule_add_exact failing
on them since they'd need to add multiple rules [1].
See the discussion at https://github.com/seccomp/libseccomp/issues/193

After discussions about the options rejected [2][3] the initial thought of
a fallback to the non '_exact' version of the seccomp rule adding the next
option is to handle those now affected (i386, s390, s390x) the same way as
ppc which ignores and does not block shmat.

[1]: https://github.com/seccomp/libseccomp/issues/193
[2]: https://github.com/systemd/systemd/pull/14167#issuecomment-559136906
[3]: https://github.com/systemd/systemd/commit/469830d1
src/shared/seccomp-util.c