<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> <body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""> Hi all, <div class=""><br class=""> </div> <div class="">My apologies if this is frowned upon, but this has been posted for a week and I haven’t gotten any feedback on it. I’d appreciate if this could get reviewed and if adequate, merged. I’m waiting on this change in order to be able to continue using systemd-nspawn containers, properly configured, to perform system tasks (such as firmware and bios flashing).</div> <div class=""><br class=""> </div> <div class="">Thanks,</div> <div class="">Jay Faulkner</div> <div class=""><br class=""> </div> <div class=""> <div> <blockquote type="cite" class=""> <div class="">On Feb 20, 2015, at 6:59 PM, Jay Faulkner <<a href="mailto:jay@jvf.cc" class="">jay@jvf.cc</a>> wrote:</div> <br class="Apple-interchange-newline"> <div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">After some additional testing, I found a bug in this patch where it would not compile with seccomp disabled. I’ve updated the patch at<span class="Apple-converted-space"> </span></span><a href="https://github.com/jayofdoom/systemd/pull/4.patch" class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://github.com/jayofdoom/systemd/pull/4.patch</a><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""> — also I’ve attached the fixed patch.</span> <div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> <br class=""> </div> <div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> -Jay</div> <div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> </div> <span id="cid:3DBA42CF2440964180A59AD6EE86FBA6@namprd02.prod.outlook.com"><refactor-nspawn-map-seccomp-to-capabilities.patch></span> <div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> <br class=""> <div class=""> <blockquote type="cite" class=""> <div class="">On Feb 20, 2015, at 4:18 PM, Jay Faulkner <<a href="mailto:jay@jvf.cc" class="">jay@jvf.cc</a>> wrote:</div> <br class="Apple-interchange-newline"> <div class=""> <div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"> Hi all, <div class=""><br class=""> </div> <div class="">At the suggestion (and with the assistance of) a co-worker, we remade this patch to not have quite as much repeated code. The new version is attached and can be found here <a href="https://github.com/jayofdoom/systemd/pull/4.patch" class="">https://github.com/jayofdoom/systemd/pull/4.patch</a> — thanks!</div> <div class=""></div> </div> <span id="cid:D67EDDCDD0AFD64DB580A23EDDB3D670@namprd02.prod.outlook.com" class=""><refactor-nspawn-map-seccomp-to-capabilities.patch></span> <div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"> <div class=""></div> <div class="">Thanks,</div> <div class="">Jay Faulkner<br class=""> <div class=""> <blockquote type="cite" class=""> <div class="">On Feb 20, 2015, at 2:24 PM, Jay Faulkner <<a href="mailto:jay@jvf.cc" class="">jay@jvf.cc</a>> wrote:</div> <br class="Apple-interchange-newline"> <div class=""> <div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"> Hi all, <div class=""><br class=""> </div> <div class="">Two weeks ago[1] I patched systemd-nspawn to respect CAP_SYS_MODULE with regards to setting seccomp filters. As I needed access to some of the other blocked syscalls as well, I have a patch to map all seccomp filters to various capabilities, and to only set those filters if the matching capability is dropped. The matching capabilities were taken from the man pages of the syscalls involved.</div> <div class=""><br class=""> </div> <div class="">I’d also suggest that in the future, additional filters use this same mapping as to avoid breaking use cases like mine in the future. :)</div> <div class=""><br class=""> </div> <div class="">The patch is attached, but in case it gets mangled in transport as the last one did, feel free to get it directly from github here: <a href="https://github.com/jayofdoom/systemd/pull/3.patch" class="">https://github.com/jayofdoom/systemd/pull/3.patch</a>.</div> <div class=""><br class=""> </div> <div class="">Thanks,</div> <div class="">Jay Faulkner</div> <div class=""></div> </div> <span id="cid:4E258E1C6C36A64CAE20CA60AAC300DA@namprd02.prod.outlook.com" class=""><nspawn-map-seccomp-to-capabilities.patch></span> <div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"> <div class=""></div> </div> _______________________________________________<br class=""> systemd-devel mailing list<br class=""> <a href="mailto:systemd-devel@lists.freedesktop.org" class="">systemd-devel@lists.freedesktop.org</a><br class=""> <a href="http://lists.freedesktop.org/mailman/listinfo/systemd-devel" class="">http://lists.freedesktop.org/mailman/listinfo/systemd-devel</a><br class=""> </div> </blockquote> </div> <br class=""> </div> </div> _______________________________________________<br class=""> systemd-devel mailing list<br class=""> <a href="mailto:systemd-devel@lists.freedesktop.org" class="">systemd-devel@lists.freedesktop.org</a><br class=""> <a href="http://lists.freedesktop.org/mailman/listinfo/systemd-devel" class="">http://lists.freedesktop.org/mailman/listinfo/systemd-devel</a><br class=""> </div> </blockquote> </div> <br class=""> </div> <span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""> <span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">systemd-devel mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""> <a href="mailto:systemd-devel@lists.freedesktop.org" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">systemd-devel@lists.freedesktop.org</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""> <a href="http://lists.freedesktop.org/mailman/listinfo/systemd-devel" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">http://lists.freedesktop.org/mailman/listinfo/systemd-devel</a></div> </blockquote> </div> <br class=""> </div> </body> </html>