Whitelist statx syscall by NobodyOnSE · Pull Request #36417 · moby/moby

NobodyOnSE · 2018-02-26T20:32:02Z

Signed-off-by: NobodyOnSE ich@sektor.selfip.com

Edited via github's webeditor, so the signoff was done manually, I hope that is enough.

The need for this addition is explained in this SO post. In short: building a Qt 5.10.1 application fails in moc because it uses statx to find includes.

- What I did
Added statx to whitelist of allowed syscalls.

- How I did it
Added it in the default.json for seccomp.

- How to verify it
Try to use statx and don't get an EPERM anymore on non-privileged containers.

- Description for the changelog
Whitelist statx syscall

- A picture of a cute animal (not mandatory but encouraged)

AkihiroSuda

This is autogenerated file.

Please edit seccomp_dewfault.go and run go generate

NobodyOnSE · 2018-02-27T14:53:37Z

@AkihiroSuda I hope that worked. I am no go programmer. I am not used to having an autogenerated file in version control.

thaJeztah · 2018-02-28T10:55:11Z

ping @justincormack @n4ss PTAL

justincormack · 2018-02-28T15:01:47Z

Thats fine but note that you will need to install libseccomp-2.3.3 on the host for this to work, as I think that is the first version with statx support.

thaJeztah · 2018-02-28T17:13:01Z

Thats fine but note that you will need to install libseccomp-2.3.3 on the host for this to work, as I think that is the first version with statx support.

What would be the effect when running on an older libseccomp? will it just ignore this configuration, and continue working as currently?

n4ss · 2018-02-28T19:28:01Z

LGTM!

NobodyOnSE · 2018-03-05T19:05:12Z

@thaJeztah I tried to emulate this case by whitelisting the fake syscall nonsense and got no error message. The container started as intended. Furthermore, the seccomp filter still seems to work as I got EPERM on a non whitelisted syscall.

thaJeztah · 2018-03-05T19:09:31Z

I tried to emulate this case by whitelisting the fake syscall nonsense and got no error message. The container started as intended. Furthermore, the seccomp filter still seems to work as I got EPERM on a non whitelisted syscall.

Thanks!

Changes LGTM; could you squash your commits, so that there's a single commit in this PR? While doing so, perhaps you could update the commit message to also mention that this requires newer versions of libseccomp, and will be ignored by older ones

Older seccomp versions will ignore this. Signed-off-by: NobodyOnSE <ich@sektor.selfip.com>

codecov · 2018-03-06T07:46:21Z

Codecov Report

❗ No coverage uploaded for pull request base (master@2f7a76a). Click here to learn what that means.
The diff coverage is 0%.

@@            Coverage Diff            @@
##             master   #36417   +/-   ##
=========================================
  Coverage          ?   34.65%           
=========================================
  Files             ?      613           
  Lines             ?    45400           
  Branches          ?        0           
=========================================
  Hits              ?    15732           
  Misses            ?    27607           
  Partials          ?     2061

NobodyOnSE · 2018-03-06T07:48:06Z

could you squash your commits,

done

update the commit message to also mention that this requires newer versions of libseccomp, and will be ignored by older ones

done

thaJeztah

LGTM, thanks!

NobodyOnSE · 2018-03-06T12:49:00Z

@thaJeztah Is there an ETA or a planned release for this PR?

thaJeztah · 2018-03-06T13:35:36Z

@NobodyOnSE it was opened after code-freeze for Docker 18.03, so currently it will be included in the release after that (18.04)

thaJeztah · 2018-03-06T13:37:14Z

If you want to try a version with this patch, nightly builds should be available soon in the "nightly" channel (e.g. nightly builds for Ubuntu 16.04 https://download.docker.com/linux/ubuntu/dists/xenial/pool/nightly/amd64/)

This whitelists the statx syscall; libseccomp-2.3.3 or up is needed for this, older seccomp versions will ignore this. Equivalent of moby/moby#36417 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

This whitelists the statx syscall; libseccomp-2.3.3 or up is needed for this, older seccomp versions will ignore this. Equivalent of moby/moby#36417 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 8f8fd3c) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Previously, moc calls fail with: standard input:0: Note: No relevant classes found. No output generated. Some relevant discussions suggest that statx functionality is needed [1], which is available with docker 18.04+ and libseccomp 2.3.3+ [2]. Ubuntu 16.04 do have libseccomp 2.4.1 [3]. Maybe Travis CI builders are just not updated. [1] Martchus/PKGBUILDs#54 [2] moby/moby#36417 [3] https://repology.org/project/libseccomp/versions

1. Adapted to arch-travis upstream changes [1] 2. Use Bionic (Ubuntu 18.04) on Travis CI Previously, moc calls fail with: standard input:0: Note: No relevant classes found. No output generated. Some relevant discussions suggest that statx functionality is needed [2], which is available with docker 18.04+ and libseccomp 2.3.3+ [3]. Ubuntu 16.04 do have libseccomp 2.4.1 [4]. Maybe Travis CI builders are just not updated. [1] mikkeloscar/arch-travis#65 [2] Martchus/PKGBUILDs#54 [3] moby/moby#36417 [4] https://repology.org/project/libseccomp/versions

... to fix issue moby/moby#36417

Fixes issues #40 as recent versions of Docker are including moby/moby#36417.

1. Adapted to arch-travis upstream changes [1] 2. Use Bionic (Ubuntu 18.04) on Travis CI Previously, moc calls fail with: standard input:0: Note: No relevant classes found. No output generated. Some relevant discussions suggest that statx functionality is needed [2], which is available with docker 18.04+ and libseccomp 2.3.3+ [3]. Ubuntu 16.04 do have libseccomp 2.4.1 [4]. Maybe Travis CI builders are just not updated. [1] mikkeloscar/arch-travis#65 [2] Martchus/PKGBUILDs#54 [3] moby/moby#36417 [4] https://repology.org/project/libseccomp/versions

GordonTheTurtle added the status/0-triage label Feb 26, 2018

AkihiroSuda requested changes Feb 27, 2018

View reviewed changes

thaJeztah added status/2-code-review area/security/seccomp and removed status/0-triage labels Feb 28, 2018

xantares mentioned this pull request Feb 28, 2018

[mingw-w64-qt5-base] standard input:0: Note: No relevant classes found. No output generated. Martchus/PKGBUILDs#54

Closed

xantares approved these changes Feb 28, 2018

View reviewed changes

xantares mentioned this pull request Feb 28, 2018

statx syscalls inside a docker container docker/for-linux#208

Closed

3 tasks

justincormack approved these changes Feb 28, 2018

View reviewed changes

Whitelist statx syscall for libseccomp-2.3.3 onward

b2a907c

Older seccomp versions will ignore this. Signed-off-by: NobodyOnSE <ich@sektor.selfip.com>

NobodyOnSE force-pushed the patch-2 branch from 1cf9aac to b2a907c Compare March 6, 2018 07:46

thaJeztah approved these changes Mar 6, 2018

View reviewed changes

thaJeztah added impact/changelog status/4-merge and removed status/2-code-review labels Mar 6, 2018

thaJeztah merged commit f0694e9 into moby:master Mar 6, 2018

NobodyOnSE deleted the patch-2 branch March 6, 2018 17:46

daniviga mentioned this pull request Jun 22, 2018

statx() requires Docker 18.04+ qgis/qgis-docker#1

Closed

mviereck mentioned this pull request Sep 15, 2018

jess/cathode: QT plugin "xcb" not found jessfraz/dockerfiles#401

Closed

salvadorcunat mentioned this pull request Oct 16, 2018

windows-container build fails when run locally subsurface/subsurface#1800

Open

4 tasks

This was referenced Oct 22, 2018

Impossible to build Qt on recent docker images conan-io/conan-docker-tools#64

Closed

update docker version on xenial travis-ci/travis-ci#10296

Closed

ericLemanissier mentioned this pull request Oct 29, 2018

Set up CI with Azure Pipelines bincrafters/conan-qt#18

Closed

This was referenced Dec 27, 2018

ubuntu:bionic image: GUIs and --network=host problems diegoferigo/development-iit#3

Closed

Qt applications and network host #38442

Open

tianon mentioned this pull request Feb 15, 2019

Base Image that fails to run only on BTRFS with /bin/bash: error in loading shared libraries: libncurses.so.5: cannot stat shared object: Error 75 #5364

Closed

thaJeztah mentioned this pull request Mar 20, 2019

buildkit: statx does not work docker/for-linux#616

Open

3 tasks

thaJeztah mentioned this pull request Mar 20, 2019

seccomp: whitelist statx syscall containerd/containerd#3111

Merged

This was referenced Mar 20, 2019

[release/1.1 backport] seccomp: whitelist statx syscall containerd/containerd#3112

Merged

[release/1.2 backport] seccomp: whitelist statx syscall containerd/containerd#3113

Merged

nforro mentioned this pull request Oct 18, 2019

Fix Travis tests rebase-helper/rebase-helper#736

Merged

jethrogb mentioned this pull request Oct 21, 2019

Compiler doesn't work when using Docker rust-lang/rust#65662

Closed

rhaschke added a commit to ubi-agni/moveit that referenced this pull request Jul 21, 2020

Travis: Update dist to Bionic

dff6085

... to fix issue moby/moby#36417

rhaschke mentioned this pull request Jul 21, 2020

Travis: Update dist to Bionic moveit/moveit#2221

Merged

rhaschke added a commit to moveit/moveit that referenced this pull request Jul 21, 2020

Travis: Update dist to Bionic (#2221)

6dbaf94

... to fix issue moby/moby#36417

rhaschke added a commit to moveit/moveit that referenced this pull request Aug 13, 2020

Travis: Update dist to Bionic (#2221)

6f519f1

... to fix issue moby/moby#36417

rhaschke added a commit to moveit/moveit that referenced this pull request Aug 13, 2020

Travis: Update dist to Bionic (#2221)

4a3c2a2

... to fix issue moby/moby#36417

olbat added a commit to olbat/dockerfiles that referenced this pull request Oct 10, 2020

Use a recent version of Docker on Travis CI

69c047c

Fixes issues #40 as recent versions of Docker are including moby/moby#36417.

olbat added a commit to olbat/dockerfiles that referenced this pull request Oct 10, 2020

Use a recent version of Docker on Travis CI

50716c6

Fixes issues #40 as recent versions of Docker are including moby/moby#36417.

olbat added a commit to olbat/dockerfiles that referenced this pull request Oct 11, 2020

Use a recent version of Docker on Travis CI

7dbde3b

Fixes issues #40 as recent versions of Docker are including moby/moby#36417.

Conversation

NobodyOnSE commented Feb 26, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AkihiroSuda left a comment

Choose a reason for hiding this comment

Uh oh!

NobodyOnSE commented Feb 27, 2018

Uh oh!

thaJeztah commented Feb 28, 2018

Uh oh!

justincormack commented Feb 28, 2018

Uh oh!

thaJeztah commented Feb 28, 2018

Uh oh!

n4ss commented Feb 28, 2018

Uh oh!

NobodyOnSE commented Mar 5, 2018

Uh oh!

thaJeztah commented Mar 5, 2018

Uh oh!

codecov bot commented Mar 6, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

NobodyOnSE commented Mar 6, 2018

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

NobodyOnSE commented Mar 6, 2018

Uh oh!

thaJeztah commented Mar 6, 2018

Uh oh!

thaJeztah commented Mar 6, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

NobodyOnSE commented Feb 26, 2018 •

edited

Loading

codecov bot commented Mar 6, 2018 •

edited

Loading