mirror of
https://github.com/OpenFusionProject/OpenFusion.git
synced 2024-11-05 06:50:04 +00:00
[sandbox] Print error message on seccomp sandbox violation
Co-authored-by: cpunch <sethtstubbs@gmail.com>
This commit is contained in:
parent
0e32a8974f
commit
6a0d8ca436
@ -61,7 +61,7 @@
|
|||||||
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO|(_errno))
|
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO|(_errno))
|
||||||
|
|
||||||
#define KILL_PROCESS \
|
#define KILL_PROCESS \
|
||||||
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL_PROCESS)
|
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRAP)
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Macros adapted from openssh's sandbox-seccomp-filter.c
|
* Macros adapted from openssh's sandbox-seccomp-filter.c
|
||||||
@ -435,12 +435,35 @@ static void landlock_init() {
|
|||||||
|
|
||||||
#endif // !CONFIG_NOLANDLOCK
|
#endif // !CONFIG_NOLANDLOCK
|
||||||
|
|
||||||
|
static void sigsys_handler(int signo, siginfo_t *info, void *context) {
|
||||||
|
// report the unhandled syscall
|
||||||
|
std::cout << "[FATAL] Unhandled syscall " << info->si_syscall
|
||||||
|
<< " at " << std::hex << info->si_call_addr << " on arch " << info->si_arch << std::endl;
|
||||||
|
|
||||||
|
std::cout << "If you're unsure why this is happening, please read https://openfusion.dev/docs/development/the-sandbox/" << std::endl
|
||||||
|
<< "for more information and possibly open an issue at https://github.com/OpenFusionProject/OpenFusion/issues to report"
|
||||||
|
<< " needed changes in our seccomp filter." << std::endl;
|
||||||
|
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
void sandbox_init() {
|
void sandbox_init() {
|
||||||
if (!settings::SANDBOX) {
|
if (!settings::SANDBOX) {
|
||||||
std::cout << "[WARN] Running without a sandbox" << std::endl;
|
std::cout << "[WARN] Running without a sandbox" << std::endl;
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// listen to SIGSYS to report unhandled syscalls
|
||||||
|
struct sigaction sa = {};
|
||||||
|
|
||||||
|
sa.sa_flags = SA_SIGINFO;
|
||||||
|
sa.sa_sigaction = sigsys_handler;
|
||||||
|
|
||||||
|
if (sigaction(SIGSYS, &sa, NULL) < 0) {
|
||||||
|
perror("sigaction");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
#ifndef CONFIG_NOLANDLOCK
|
#ifndef CONFIG_NOLANDLOCK
|
||||||
landlock_init();
|
landlock_init();
|
||||||
#else
|
#else
|
||||||
|
Loading…
Reference in New Issue
Block a user