snap-confine, snap-seccomp: utilize new seccomp logging features - 2.32#4803
Merged
mvo5 merged 6 commits intocanonical:release/2.32from Mar 14, 2018
Merged
snap-confine, snap-seccomp: utilize new seccomp logging features - 2.32#4803mvo5 merged 6 commits intocanonical:release/2.32from
mvo5 merged 6 commits intocanonical:release/2.32from
Conversation
…onical#3998) * snap-confine, snap-seccomp: Default to SECCOMP_RET_ERRNO The seccomp policy has historically used SECCOMP_RET_KILL to forcefully kill a snap process that bumps into the walls of the sandbox. However, killing the snap is not very user friendly. Changing the policy to use SECCOMP_RET_ERRNO to return -1 with errno set to EPERM has been desired but the kernel would not log those denials which could leave users and developers confused about why their applications were experiencing errors. The 4.14 Linux kernel contains new seccomp logging controls which allows snapd to request SECCOMP_RET_ERRNO to be logged. This patch makes use of the new logging controls and switches the default action of the seccomp policy to SECCOMP_RET_ERRNO so that snaps aren't killed when the perform an illegal system call. Signed-off-by: Tyler Hicks <[email protected]>
mvo5
reviewed
Mar 8, 2018
vendor/vendor.json
Outdated
| "path": "github.com/mvo5/libseccomp-golang", | ||
| "revision": "84e1d1c75beaa58be6a76d2fc94d95eb8c1583b6", | ||
| "revisionTime": "2017-06-14T13:46:31Z" | ||
| "revision": "e0e036d8f7d25f0c63e96896b99547e9d5f71617", |
Contributor
There was a problem hiding this comment.
This needs an update to the latest https://github.com/mvo5/libseccomp-golang/commits/master (f4de83b52afb3c19190eb65cc92429feaaf0e8b6) ?
Signed-off-by: Zygmunt Krynicki <[email protected]>
Contributor
|
We will need #4807 to make tests pass again on 2.32 (which is currently broken because of too much cherry-picking :/ |
Author
|
Thank you for adjusting vendor/vendor.json! I went to do it now and it was already done. |
Codecov Report
@@ Coverage Diff @@
## release/2.32 #4803 +/- ##
================================================
+ Coverage 78.61% 78.64% +0.02%
================================================
Files 470 471 +1
Lines 33877 33919 +42
================================================
+ Hits 26632 26674 +42
- Misses 5079 5081 +2
+ Partials 2166 2164 -2
Continue to review full report at Codecov.
|
mvo5
approved these changes
Mar 14, 2018
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#3998 for 2.32