summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2018-03-17 08:49:24 +0000
committerColin Watson <cjwatson@debian.org>2018-03-17 08:51:45 +0000
commit232899c9776625e75cec72a4fb9e588968a6fa2f (patch)
tree1d002528d7ce4e5098a36e1412088237ab4909d7
parentecba2e037bcb33b7fd4f0caa7bc42bd05fefdfd6 (diff)
downloadman-db-232899c9776625e75cec72a4fb9e588968a6fa2f.tar.gz
sandbox: Allow kill and tgkill outright
This is unfortunate but unavoidable: groff uses kill to explicitly pass on SIGPIPE to its child processes, and we can't do any more sophisticated filtering in seccomp. Based on a patch by Paul Wise. Fixes Debian bug #892309. * lib/sandbox.c (make_seccomp_filter): Allow kill and tgkill unconditionally. (adjust_seccomp_filter): Remove. (_sandbox_load): Remove call to adjust_seccomp_filter. * NEWS: Document this.
-rw-r--r--NEWS3
-rw-r--r--lib/sandbox.c31
2 files changed, 11 insertions, 23 deletions
diff --git a/NEWS b/NEWS
index 26a7238..a963155 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,9 @@ Major changes since man-db 2.8.2:
* Make seccomp sandbox allow madvise, since that's used by lbzip2.
+ * Make seccomp sandbox allow kill and tgkill outright, since groff
+ uses kill to pass on signals to its child processes.
+
man-db 2.8.2 (28 February 2018)
===============================
diff --git a/lib/sandbox.c b/lib/sandbox.c
index 649d107..7c9d306 100644
--- a/lib/sandbox.c
+++ b/lib/sandbox.c
@@ -483,6 +483,14 @@ scmp_filter_ctx make_seccomp_filter (int permissive)
SC_ALLOW ("sysinfo");
SC_ALLOW ("uname");
+ /* Allow killing processes and threads. This is unfortunate but
+ * unavoidable: groff uses kill to explicitly pass on SIGPIPE to its
+ * child processes, and we can't do any more sophisticated filtering
+ * in seccomp.
+ */
+ SC_ALLOW ("kill");
+ SC_ALLOW ("tgkill");
+
/* Some antivirus programs use an LD_PRELOAD wrapper that wants to
* talk to a private daemon using a Unix-domain socket. We really
* don't want to allow these syscalls in general, but if such a
@@ -508,33 +516,11 @@ scmp_filter_ctx make_seccomp_filter (int permissive)
SC_ALLOW_ARG_1 ("shmctl", SCMP_A1 (SCMP_CMP_EQ, IPC_STAT));
SC_ALLOW ("shmdt");
SC_ALLOW_ARG_1 ("shmget", SCMP_A2 (SCMP_CMP_EQ, 0));
- SC_ALLOW_ARG_1 ("kill", SCMP_A1 (SCMP_CMP_EQ, 0));
}
return ctx;
}
-/* Adjust an existing seccomp filter for the current process.
- *
- * This is playing with fire: seccomp_rule_add allocates memory, so is
- * formally unsafe in a pre-exec hook. On the other hand, seccomp_load
- * allocates memory too. To fix this, we need to export the seccomp filter
- * to a fixed memory structure first and then fill in the gaps here. We may
- * need to stop using libseccomp, since it doesn't really provide this kind
- * of facility.
- */
-void adjust_seccomp_filter (scmp_filter_ctx ctx)
-{
- pid_t pid;
-
- /* Allow sending signals, but only to the current process or to
- * threads in the current thread group.
- */
- pid = getpid ();
- SC_ALLOW_ARG_1 ("kill", SCMP_A0 (SCMP_CMP_EQ, pid));
- SC_ALLOW_ARG_1 ("tgkill", SCMP_A0 (SCMP_CMP_EQ, pid));
-}
-
#undef SC_ALLOW_ARG_2
#undef SC_ALLOW_ARG_1
#undef SC_ALLOW
@@ -571,7 +557,6 @@ void _sandbox_load (man_sandbox *sandbox, int permissive) {
ctx = sandbox->permissive_ctx;
else
ctx = sandbox->ctx;
- adjust_seccomp_filter (ctx);
if (seccomp_load (ctx) < 0) {
if (errno == EINVAL || errno == EFAULT) {
/* The kernel doesn't give us particularly