diff options
| author | Colin Watson <cjwatson@debian.org> | 2018-03-17 08:49:24 +0000 |
|---|---|---|
| committer | Colin Watson <cjwatson@debian.org> | 2018-03-17 08:51:45 +0000 |
| commit | 232899c9776625e75cec72a4fb9e588968a6fa2f (patch) | |
| tree | 1d002528d7ce4e5098a36e1412088237ab4909d7 | |
| parent | ecba2e037bcb33b7fd4f0caa7bc42bd05fefdfd6 (diff) | |
| download | man-db-232899c9776625e75cec72a4fb9e588968a6fa2f.tar.gz | |
sandbox: Allow kill and tgkill outright
This is unfortunate but unavoidable: groff uses kill to explicitly pass
on SIGPIPE to its child processes, and we can't do any more
sophisticated filtering in seccomp.
Based on a patch by Paul Wise. Fixes Debian bug #892309.
* lib/sandbox.c (make_seccomp_filter): Allow kill and tgkill
unconditionally.
(adjust_seccomp_filter): Remove.
(_sandbox_load): Remove call to adjust_seccomp_filter.
* NEWS: Document this.
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | lib/sandbox.c | 31 |
2 files changed, 11 insertions, 23 deletions
@@ -8,6 +8,9 @@ Major changes since man-db 2.8.2: * Make seccomp sandbox allow madvise, since that's used by lbzip2. + * Make seccomp sandbox allow kill and tgkill outright, since groff + uses kill to pass on signals to its child processes. + man-db 2.8.2 (28 February 2018) =============================== diff --git a/lib/sandbox.c b/lib/sandbox.c index 649d107..7c9d306 100644 --- a/lib/sandbox.c +++ b/lib/sandbox.c @@ -483,6 +483,14 @@ scmp_filter_ctx make_seccomp_filter (int permissive) SC_ALLOW ("sysinfo"); SC_ALLOW ("uname"); + /* Allow killing processes and threads. This is unfortunate but + * unavoidable: groff uses kill to explicitly pass on SIGPIPE to its + * child processes, and we can't do any more sophisticated filtering + * in seccomp. + */ + SC_ALLOW ("kill"); + SC_ALLOW ("tgkill"); + /* Some antivirus programs use an LD_PRELOAD wrapper that wants to * talk to a private daemon using a Unix-domain socket. We really * don't want to allow these syscalls in general, but if such a @@ -508,33 +516,11 @@ scmp_filter_ctx make_seccomp_filter (int permissive) SC_ALLOW_ARG_1 ("shmctl", SCMP_A1 (SCMP_CMP_EQ, IPC_STAT)); SC_ALLOW ("shmdt"); SC_ALLOW_ARG_1 ("shmget", SCMP_A2 (SCMP_CMP_EQ, 0)); - SC_ALLOW_ARG_1 ("kill", SCMP_A1 (SCMP_CMP_EQ, 0)); } return ctx; } -/* Adjust an existing seccomp filter for the current process. - * - * This is playing with fire: seccomp_rule_add allocates memory, so is - * formally unsafe in a pre-exec hook. On the other hand, seccomp_load - * allocates memory too. To fix this, we need to export the seccomp filter - * to a fixed memory structure first and then fill in the gaps here. We may - * need to stop using libseccomp, since it doesn't really provide this kind - * of facility. - */ -void adjust_seccomp_filter (scmp_filter_ctx ctx) -{ - pid_t pid; - - /* Allow sending signals, but only to the current process or to - * threads in the current thread group. - */ - pid = getpid (); - SC_ALLOW_ARG_1 ("kill", SCMP_A0 (SCMP_CMP_EQ, pid)); - SC_ALLOW_ARG_1 ("tgkill", SCMP_A0 (SCMP_CMP_EQ, pid)); -} - #undef SC_ALLOW_ARG_2 #undef SC_ALLOW_ARG_1 #undef SC_ALLOW @@ -571,7 +557,6 @@ void _sandbox_load (man_sandbox *sandbox, int permissive) { ctx = sandbox->permissive_ctx; else ctx = sandbox->ctx; - adjust_seccomp_filter (ctx); if (seccomp_load (ctx) < 0) { if (errno == EINVAL || errno == EFAULT) { /* The kernel doesn't give us particularly |
