-
Notifications
You must be signed in to change notification settings - Fork 38.7k
util: Make syscall sandbox compilable with kernel 4.4.0 #23196
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Kernel 4.4.0 doesn't define this.
Put these in `#ifdef` as they are newer syscalls that might not be
defined on all kernels:
__NR_pkey_alloc
__NR_pkey_free
__NR_pkey_mprotect
__NR_preadv2
__NR_pwritev2
Thanks to jamesob for reporting.
|
Reported by jamesob on IRC, see https://gist.github.com/jamesob/c46513d41e355a3e6e69f4ff78167c92 I'm still thinking we might want to remove the syscall name table, and replace it with instructions how to look up the number (e.g. as argued here #20487 (comment)). Having this list of syscall constants we don't actually use, besides for error reporting, seems asking for more and more PRs like this. |
|
Concept ACK |
|
What we also could do is add an autoconf test, and fail the |
|
cr ACK ac402e7 Thanks for quickly addressing this! This might be helpful to fellow reviewers: |
|
Some syscall history: The newest syscall in the These syscalls were introduced from Linux 3.17 (2014) to Linux 4.12 (2017):
Source: https://man7.org/linux/man-pages/man2/syscalls.2.html |
|
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers. ConflictsReviewers, this pull request conflicts with the following ones:
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first. |
|
Some additional review comments: I've done some additional digging and Linux 4.4 (2016) is the oldest kernel that is not EOL. Thus it should only be the syscalls introduced after Linux 4.4 that are part of the This should be the complete list of such syscalls:
All the syscalls listed above are covered (either via Thus we shouldn't see any more compile-time issues on supported non-EOL systems after the merge of this PR :) |
|
@practicalswift Whoa, thanks for doing some software archeology there.
I think the main users of EOL kernels are people stuck with the vendor kernel for some embedded board. But even if ARM would be supported for sandboxing, it's always possible to disable it with configure, it's not like this prevents compilation altogether. |
…l 4.4.0 ac402e7 util: Conditionalize some syscalls in syscall name table (W. J. van der Laan) 64085b3 util: Add __NR_copy_file_range syscall constant for sandbox (W. J. van der Laan) Pull request description: Make the new syscall sandbox compilable with kernel 4.4.0. This defines a further syscall constant `__NR_copy_file_range` to make sure all syscalls used in the profile are available even if not defined in the kernel headers. Also, make a few syscalls optional in the syscall name table: - `__NR_pkey_alloc` - `__NR_pkey_free` - `__NR_pkey_mprotect` - `__NR_preadv2` - `__NR_pwritev2` ACKs for top commit: practicalswift: cr ACK ac402e7 Tree-SHA512: be6c55bf0a686bcdfad0b80b950d0d7d77a559ac234fc997b47514bdba44865a371c96dd8d34a811ba46424a84f410e23f75485b9b1e69e529b7d40e0b4b91b8
Make the new syscall sandbox compilable with kernel 4.4.0.
This defines a further syscall constant
__NR_copy_file_rangeto make sure all syscalls used in the profile are available even if not defined in the kernel headers.Also, make a few syscalls optional in the syscall name table:
__NR_pkey_alloc__NR_pkey_free__NR_pkey_mprotect__NR_preadv2__NR_pwritev2