From 5a2f693f07a1e93ada5277b2fb1530b2698be0fa Mon Sep 17 00:00:00 2001 From: Daniel P. Berrangé Date: Thu, 29 Jul 2021 13:32:37 +0100 Subject: seccomp: fix blocking of process spawning When '-sandbox on,spawn=deny' is given, we are supposed to block the ability to spawn processes. We naively blocked the 'fork' syscall, forgetting that any modern libc will use the 'clone' syscall instead. We can't simply block the 'clone' syscall though, as that will break thread creation. We thus list the set of flags used to create threads and block anything that doesn't match this exactly. Acked-by: Eduardo Otubo Signed-off-by: Daniel P. Berrangé --- tests/unit/test-seccomp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'tests') diff --git a/tests/unit/test-seccomp.c b/tests/unit/test-seccomp.c index 10ab3e8fe5..3d7771e46c 100644 --- a/tests/unit/test-seccomp.c +++ b/tests/unit/test-seccomp.c @@ -126,8 +126,7 @@ static int doit_fork(void) static void test_seccomp_fork_on_nospawn(void) { - /* XXX fixme - should be killed */ - test_seccomp_passed("on,spawn=deny", doit_fork); + test_seccomp_killed("on,spawn=deny", doit_fork); } static void test_seccomp_fork_on(void) -- cgit v1.2.3-55-g7522