snapd

~mvo/snapd/+git/snapd-mvo:rework-seccomp-denylist-incoperate-global.bin

Git
lp:~mvo/snapd/+git/snapd-mvo
rework-seccomp-denylist-incoperate-gl...

Last commit made on 2023-07-31

Get this branch:: git clone -b rework-seccomp-denylist-incoperate-global.bin https://git.launchpad.net/~mvo/snapd/+git/snapd-mvo

Branch merges

Branch information

Name:: rework-seccomp-denylist-incoperate-global.bin

Repository:: lp:~mvo/snapd/+git/snapd-mvo

Recent commits

21c2a05... by Michael Vogt on 2023-07-27

snap-{seccomp,confine}: replace global seccomp filter with template

The global.bin seccomp filter was written before we had support for
explicit deny rules in snap-seccomp. With these rules we can replace
the hard to followup logic of the global filter and just make the
rules part of the standard seccomp template.

The global rules are best summarized in this comment:
```
struct scmp_arg_cmp no_tty_inject = {
    /* We learned that existing programs make legitimate requests with all
     * bits set in the more significant 32bit word of the 64 bit double
     * word. While this kernel behavior remains suspect and presumably
     * undesired it is unlikely to change for backwards compatibility
     * reasons. As such we cannot block all requests with high-bits set.
     *
     * When faced with ioctl(fd, request); refuse to proceed when
     * request&0xffffffff == TIOCSTI. This specific way to encode the
     * filter has the following important properties:
     *
     * - it blocks ioctl(fd, TIOCSTI, ptr).
     * - it also blocks ioctl(fd, (1UL<<32) | TIOCSTI, ptr).
     * - it doesn't block ioctl(fd, (1UL<<32) | (request not equal to TIOCSTI), ptr); */
    .arg = 1,
    .op = SCMP_CMP_MASKED_EQ,
    .datum_a = 0xffffffffUL,
    .datum_b = TIOCSTI,
};
sc_err = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), sys_ioctl_nr, 1, no_tty_inject);
```
and the same for `TIOCLINUX`.

c584cb0... by Michael Vogt on 2023-07-10

snap-{seccomp,confine}: rework seccomp denylist

When a denylist was introduced in PR#12849 we reached the limits
of the API of libseccomp and some things are now hard to reason
about [1]. This is mostly because what we try to do does not
match the libseccomp API very well and a slightly different
approach is probably more aligned with it's design (see also
this libseccomp issue [2] that is related to our issue).

So this commit changes the approach and instead of trying to use
a single filter the work is split into two filters:
1. explicit allow list
2. explicit deny list

and then load both filters into the kernel. The way the kernel
works is that it selects the most restrictive action.

So in the case of PR#12849:
```
~ioctl - TIOCSTI
~ioctl - TIOCLINUX
ioctl
```
For `ioctl(TIOCLINUX)` the first allow filter would pass `ioctl`
but the second deny filter would correctly deny the TIOCLINUX.

The file format of the `snap.snap.app.bin` changes to `.bin2`
and includes a proper header that would allow us to extend more
easily in the future.

The exiting tests for negative filtering got also updated so that
the deny/allow is tested via different errno numbers to ensure that
the expected filter denies the access.

The `snap-seccomp` spread test now also runs on all ubuntu releases.

This work will also allow us to remove the `global.bin` seccomp
filter in a followup PR.

[1] https://github.com/snapcore/snapd/pull/12849#discussion_r1206855700
[2] https://github.com/seccomp/libseccomp/issues/44

b028176... by Zeyad Gouda on 2023-07-31

many: implement snap install --prefer (#12993)

* many: implement snap install --prefer