BUG: add ipc and socket multiplexing support to ppc64 by drakenclimber · Pull Request #229 · seccomp/libseccomp

drakenclimber · 2020-04-02T16:53:26Z

I was able to get some time on a ppc64le box, so I fixed the ppc64 multiplexing and munging of the ipc syscalls. Like s390, ppc64 doesn't support semop()

Note that this branch has a commit (enable ppc64 on travis) that should not be committed.

coveralls · 2020-04-02T17:35:34Z

Coverage increased (+0.1%) to 92.806% when pulling c388bfd on drakenclimber:pull/215ppc into c561096 on seccomp:master.

pcmoore · 2020-04-02T18:34:32Z

Note that this branch has a commit (enable ppc64 on travis) that should not be committed.

There is no harm in fixing up the Travis CI patch and submitting it via this PR, we can just drop the other PR.

pcmoore · 2020-04-02T18:37:30Z

Two quick takes on this patch:

We are clearly missing some test coverage somewhere, we likely already have the test written we just need to add ppc64le to the test.
A terrible thought just occurred to me: even though ppc64[le] has support for direct-wired syscalls long before seccomp-bpf was added, the kernel still supports the socketcall() syscall, right? This means we still need to add the socket munging as well as the kernel still has the older multiplexed API available.

drakenclimber · 2020-04-02T19:29:45Z

we likely already have the test written we just need to add ppc64le to the test.

Yeah, coveralls sent me a nastygram about the drop in coverage. I'll address that.

the kernel still supports the socketcall() syscall, right?

Yes, socketcall() is syscall 102 on PPC. I think I have that fully covered in this patch - I added both munge functions for name/num as well as the mux/demux functions for the syscalls.

There is no harm in fixing up the Travis CI patch and submitting it via this PR, we can just drop the other PR.

Sounds good. I'll make the travis ci commit comment correct and add it to this patchset.

pcmoore · 2020-04-02T20:39:44Z

Yes, socketcall() is syscall 102 on PPC. I think I have that fully covered in this patch - I added both munge functions for name/num as well as the mux/demux functions for the syscalls.

I don't see the socketcall() related syscalls in the munge functions ... ?

drakenclimber · 2020-04-02T20:42:47Z

Yes, socketcall() is syscall 102 on PPC. I think I have that fully covered in this patch - I added both munge functions for name/num as well as the mux/demux functions for the syscalls.

I don't see the socketcall() related syscalls in the munge functions ... ?

Sorry I still had ipc on my mind. Oi.

I'm cool with adding the socket syscalls as well. Looks like I should add ppc64le to test #30 also.

pcmoore · 2020-04-13T00:15:09Z

Just checking in @drakenclimber, I see some code updates to this PR but not comments here, is this ready for further review or are you still playing with it?

drakenclimber · 2020-04-13T21:13:12Z

Just checking in @drakenclimber, I see some code updates to this PR but not comments here, is this ready for further review or are you still playing with it?

Yes, I believe this is now ready to go. Both IPC and socket calls now appear to be fully supported on ppc64

pcmoore · 2020-04-15T02:12:41Z

Sweet, go ahead and merge those patches!

Acked-by: Paul Moore <paul@paul-moore.com>

This commit adds support to ppc64 for ipc and socket calls that are multiplexed. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Acked-by: Paul Moore <paul@paul-moore.com>

This commit adds the ppc64le architecture to test 36-sim-ipc_syscalls. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Acked-by: Paul Moore <paul@paul-moore.com>

This commit adds the ppc64le architecture to test 30-sim-socket_syscalls. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Acked-by: Paul Moore <paul@paul-moore.com>

This commit enables TravisCI to run the automated tests on powerpc64le. Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>

This partially reverts da1921a. Fixes systemd#17559. Quoting systemd#17559: libseccomp 2.5 added socket syscall multiplexing on ppc64(el): seccomp/libseccomp#229 Like with i386, s390 and s390x this breaks socket argument filtering, so RestrictAddressFamilies doesn't work. This causes the unit test to fail: /* test_restrict_address_families */ Operating on architecture: ppc Failed to install socket family rules for architecture ppc, skipping: Operation canceled Operating on architecture: ppc64 Failed to add socket() rule for architecture ppc64, skipping: Invalid argument Operating on architecture: ppc64-le Failed to add socket() rule for architecture ppc64-le, skipping: Invalid argument Assertion 'fd < 0' failed at src/test/test-seccomp.c:424, function test_restrict_address_families(). Aborting. The socket filters can't be added so `socket(AF_UNIX, SOCK_DGRAM, 0);` still works, triggering the assertion.

This reverts the gist of da1921a and 0d9fca7 (for ppc). Quoting systemd#17559: > libseccomp 2.5 added socket syscall multiplexing on ppc64(el): > seccomp/libseccomp#229 > > Like with i386, s390 and s390x this breaks socket argument filtering, so > RestrictAddressFamilies doesn't work. > > This causes the unit test to fail: > /* test_restrict_address_families */ > Operating on architecture: ppc > Failed to install socket family rules for architecture ppc, skipping: Operation canceled > Operating on architecture: ppc64 > Failed to add socket() rule for architecture ppc64, skipping: Invalid argument > Operating on architecture: ppc64-le > Failed to add socket() rule for architecture ppc64-le, skipping: Invalid argument > Assertion 'fd < 0' failed at src/test/test-seccomp.c:424, function test_restrict_address_families(). Aborting. > > The socket filters can't be added so `socket(AF_UNIX, SOCK_DGRAM, 0);` still > works, triggering the assertion. Fixes systemd#17559.

This reverts the gist of da1921a and 0d9fca7 (for ppc). Quoting #17559: > libseccomp 2.5 added socket syscall multiplexing on ppc64(el): > seccomp/libseccomp#229 > > Like with i386, s390 and s390x this breaks socket argument filtering, so > RestrictAddressFamilies doesn't work. > > This causes the unit test to fail: > /* test_restrict_address_families */ > Operating on architecture: ppc > Failed to install socket family rules for architecture ppc, skipping: Operation canceled > Operating on architecture: ppc64 > Failed to add socket() rule for architecture ppc64, skipping: Invalid argument > Operating on architecture: ppc64-le > Failed to add socket() rule for architecture ppc64-le, skipping: Invalid argument > Assertion 'fd < 0' failed at src/test/test-seccomp.c:424, function test_restrict_address_families(). Aborting. > > The socket filters can't be added so `socket(AF_UNIX, SOCK_DGRAM, 0);` still > works, triggering the assertion. Fixes #17559.

This reverts the gist of da1921a and 0d9fca7 (for ppc). Quoting #17559: > libseccomp 2.5 added socket syscall multiplexing on ppc64(el): > seccomp/libseccomp#229 > > Like with i386, s390 and s390x this breaks socket argument filtering, so > RestrictAddressFamilies doesn't work. > > This causes the unit test to fail: > /* test_restrict_address_families */ > Operating on architecture: ppc > Failed to install socket family rules for architecture ppc, skipping: Operation canceled > Operating on architecture: ppc64 > Failed to add socket() rule for architecture ppc64, skipping: Invalid argument > Operating on architecture: ppc64-le > Failed to add socket() rule for architecture ppc64-le, skipping: Invalid argument > Assertion 'fd < 0' failed at src/test/test-seccomp.c:424, function test_restrict_address_families(). Aborting. > > The socket filters can't be added so `socket(AF_UNIX, SOCK_DGRAM, 0);` still > works, triggering the assertion. Fixes #17559. (cherry picked from commit d5923e3)

This reverts the gist of da1921a and 0d9fca7 (for ppc). Quoting #17559: > libseccomp 2.5 added socket syscall multiplexing on ppc64(el): > seccomp/libseccomp#229 > > Like with i386, s390 and s390x this breaks socket argument filtering, so > RestrictAddressFamilies doesn't work. > > This causes the unit test to fail: > /* test_restrict_address_families */ > Operating on architecture: ppc > Failed to install socket family rules for architecture ppc, skipping: Operation canceled > Operating on architecture: ppc64 > Failed to add socket() rule for architecture ppc64, skipping: Invalid argument > Operating on architecture: ppc64-le > Failed to add socket() rule for architecture ppc64-le, skipping: Invalid argument > Assertion 'fd < 0' failed at src/test/test-seccomp.c:424, function test_restrict_address_families(). Aborting. > > The socket filters can't be added so `socket(AF_UNIX, SOCK_DGRAM, 0);` still > works, triggering the assertion. Fixes #17559. (cherry picked from commit d5923e3) (cherry picked from commit 6cea4fc)

This reverts the gist of da1921a and 0d9fca7 (for ppc). Quoting #17559: > libseccomp 2.5 added socket syscall multiplexing on ppc64(el): > seccomp/libseccomp#229 > > Like with i386, s390 and s390x this breaks socket argument filtering, so > RestrictAddressFamilies doesn't work. > > This causes the unit test to fail: > /* test_restrict_address_families */ > Operating on architecture: ppc > Failed to install socket family rules for architecture ppc, skipping: Operation canceled > Operating on architecture: ppc64 > Failed to add socket() rule for architecture ppc64, skipping: Invalid argument > Operating on architecture: ppc64-le > Failed to add socket() rule for architecture ppc64-le, skipping: Invalid argument > Assertion 'fd < 0' failed at src/test/test-seccomp.c:424, function test_restrict_address_families(). Aborting. > > The socket filters can't be added so `socket(AF_UNIX, SOCK_DGRAM, 0);` still > works, triggering the assertion. Fixes #17559. (cherry picked from commit d5923e3) Resolves: #1982650

This reverts the gist of da1921a5c396547261c8c7fcd94173346eb3b718 and 0d9fca76bb69e162265b2d25cb79f1890c0da31b (for ppc). Quoting #17559: > libseccomp 2.5 added socket syscall multiplexing on ppc64(el): > seccomp/libseccomp#229 > > Like with i386, s390 and s390x this breaks socket argument filtering, so > RestrictAddressFamilies doesn't work. > > This causes the unit test to fail: > /* test_restrict_address_families */ > Operating on architecture: ppc > Failed to install socket family rules for architecture ppc, skipping: Operation canceled > Operating on architecture: ppc64 > Failed to add socket() rule for architecture ppc64, skipping: Invalid argument > Operating on architecture: ppc64-le > Failed to add socket() rule for architecture ppc64-le, skipping: Invalid argument > Assertion 'fd < 0' failed at src/test/test-seccomp.c:424, function test_restrict_address_families(). Aborting. > > The socket filters can't be added so `socket(AF_UNIX, SOCK_DGRAM, 0);` still > works, triggering the assertion. Fixes #17559. (cherry picked from commit d5923e38bc0e6cf9d7620ed5f1f8606fe7fe1168) Resolves: #1982650

pcmoore linked an issue Apr 2, 2020 that may be closed by this pull request

RFE: enable the full range of architectures supported by Travis CI #214

Closed

pcmoore changed the title ~~BUG: Add ipc multiplexing support to ppc64~~ BUG: add ipc multiplexing support to ppc64 Apr 2, 2020

drakenclimber force-pushed the pull/215ppc branch from cb57570 to 95e9b4b Compare April 2, 2020 19:59

drakenclimber force-pushed the pull/215ppc branch from 95e9b4b to abfd418 Compare April 2, 2020 22:44

pcmoore mentioned this pull request Apr 2, 2020

RFE: enable s390x and ppc64le in Travis #215

Closed

drakenclimber force-pushed the pull/215ppc branch from abfd418 to fd289b9 Compare April 3, 2020 15:43

drakenclimber changed the title ~~BUG: add ipc multiplexing support to ppc64~~ BUG: add ipc and socket multiplexing support to ppc64 Apr 3, 2020

pcmoore added bug priority/medium labels Apr 13, 2020

drakenclimber added 4 commits April 15, 2020 09:09

ppc64: Add multiplexing support for ipc and socket syscalls

89be1ac

This commit adds support to ppc64 for ipc and socket calls that are multiplexed. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Acked-by: Paul Moore <paul@paul-moore.com>

tests: Also test ppc64le in test 36

fe587c0

This commit adds the ppc64le architecture to test 36-sim-ipc_syscalls. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Acked-by: Paul Moore <paul@paul-moore.com>

tests: Also test ppc64le in test 30

07d5381

This commit adds the ppc64le architecture to test 30-sim-socket_syscalls. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Acked-by: Paul Moore <paul@paul-moore.com>

travis: enable ppc64le

c388bfd

This commit enables TravisCI to run the automated tests on powerpc64le. Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>

drakenclimber force-pushed the pull/215ppc branch from fd289b9 to c388bfd Compare April 15, 2020 15:09

drakenclimber merged commit ff2a538 into seccomp:master Apr 15, 2020

drakenclimber deleted the pull/215ppc branch May 26, 2020 19:31

debfx mentioned this pull request Nov 9, 2020

RestrictAddressFamilies fails on ppc64 with libseccomp 2.5 systemd/systemd#17559

Closed

keszybz mentioned this pull request Nov 25, 2020

test-seccomp: assume socket filtering is broken on powerpc too systemd/systemd#17722

Merged

mrc0mmand mentioned this pull request Aug 2, 2021

(#1982650) shared/seccomp-util: address family filtering is broken on ppc redhat-plumbers/systemd-rhel8#204

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BUG: add ipc and socket multiplexing support to ppc64#229

BUG: add ipc and socket multiplexing support to ppc64#229
drakenclimber merged 4 commits intoseccomp:masterfrom
drakenclimber:pull/215ppc

drakenclimber commented Apr 2, 2020

Uh oh!

coveralls commented Apr 2, 2020 •

edited

Loading

Uh oh!

pcmoore commented Apr 2, 2020

Uh oh!

pcmoore commented Apr 2, 2020

Uh oh!

drakenclimber commented Apr 2, 2020

Uh oh!

pcmoore commented Apr 2, 2020

Uh oh!

drakenclimber commented Apr 2, 2020

Uh oh!

pcmoore commented Apr 13, 2020

Uh oh!

drakenclimber commented Apr 13, 2020 •

edited

Loading

Uh oh!

pcmoore commented Apr 15, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

drakenclimber commented Apr 2, 2020

Uh oh!

coveralls commented Apr 2, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pcmoore commented Apr 2, 2020

Uh oh!

pcmoore commented Apr 2, 2020

Uh oh!

drakenclimber commented Apr 2, 2020

Uh oh!

pcmoore commented Apr 2, 2020

Uh oh!

drakenclimber commented Apr 2, 2020

Uh oh!

pcmoore commented Apr 13, 2020

Uh oh!

drakenclimber commented Apr 13, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pcmoore commented Apr 15, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coveralls commented Apr 2, 2020 •

edited

Loading

drakenclimber commented Apr 13, 2020 •

edited

Loading