Ubuntu
ubuntu-core-launcher package

implement seccomp filtering by argument

Bug #1446748 reported by Jamie Strandboge
22
This bug affects 3 people
Affects Status Importance Assigned to Milestone
ubuntu-core-launcher (Ubuntu)
Fix Released
Wishlist
Jamie Strandboge

Bug Description

The ubuntu-core-launcher should support argument filtering. While argument filtering is limited to integers currently, even this is useful for differentiating between network-client and network-service (eg, the 'socket' syscall in network-client would have filtering that does not allow tcp and udp, whereas the 'socket' syscall in 'network-service' would).

This is not for 15.04.

Related branches

lp://qastaging/~jdstrand/snap-confine/seccom-arg-filtering
Tyler Hicks: Pending requested
Snappy Developers: Pending requested
Diff: 974 lines (+823/-31)
10 files modified
README (+82/-18)
debian/changelog (+1/-0)
src/seccomp.c (+313/-13)
tests/test_bad_seccomp_filter_args (+54/-0)
tests/test_bad_seccomp_filter_args_null (+51/-0)
tests/test_bad_seccomp_filter_args_prctl (+55/-0)
tests/test_bad_seccomp_filter_args_socket (+55/-0)
tests/test_restrictions_working_args (+96/-0)
tests/test_restrictions_working_args_prctl (+58/-0)
tests/test_restrictions_working_args_socket (+58/-0)
Jamie Strandboge (jdstrand)
tags: added: application-confinement
Jamie Strandboge (jdstrand)
Changed in ubuntu-core-launcher (Ubuntu):
status: New → Triaged
importance: Undecided → Wishlist
Jamie Strandboge (jdstrand)
Changed in ubuntu-core-launcher (Ubuntu):
status: Triaged → In Progress
assignee: nobody → Jamie Strandboge (jdstrand)
Jamie Strandboge (jdstrand)
no longer affects: ubuntu-core-security (Ubuntu)
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

I'm going to mark this as 'fixed released' since it is fixed in snap-confine in series 16.

Changed in ubuntu-core-launcher (Ubuntu):
status: In Progress → Fix Released
Revision history for this message
Olivier Paroz (oparoz) wrote :

This doesn't seem to be fixed as I've just had a Snap fail because it did a syscall to fchown32, which, according to the seccomp profile will fail until this bug here is solved.

16.04.1
snap-confine/now 1.0.42-0ubuntu3 armhf

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

@Olivier - the feature is implemented but the policy doesn't yet have an update for this denial. That will be fixed in the coming weeks.

Revision history for this message
Olivier Paroz (oparoz) wrote :

Thank you Jamie!

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.