Github/nsjail
1
0
Fork 0
mirror of https://github.com/google/nsjail.git synced 2026-08-30 18:41:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

unotify: trace faccessat2, truncate, statfs and the xattr syscalls

Browse Source 
These path based syscalls are not in kTracedSyscalls, and the generated policy
ends in DEFAULT ALLOW, so they run unobserved and never reach the report.

Measured against the report of a run under --seccomp_unotify, using the glibc
wrappers rather than raw syscall numbers, on a file and on a symlink to it:

  truncate() shrank the file from 21 to 3 bytes inside the jail, verified from
  outside. The report attributed no truncate to that path.

  setfattr set an attribute on a file inside the jail; the attribute was still
  there after the run, and the report attributed nothing to that path.

  glibc faccessat(AT_EACCESS) produced no entry at all, and no faccessat
  appeared either, so glibc had issued faccessat2.

faccessat2 is the same case as the statx entry added in c20246a: modern glibc
reaches for it first and only falls back to the traced faccessat on older
kernels. A plain access(2) is still traced by its own entry; what goes unseen
is the check made through faccessat().

truncate changes a file's contents without opening it, so nothing in the report
marks that path as written.

The l* variants are listed separately, the same way stat and lstat are, and are
exercised through a symlink so that all eleven entries are covered.

The flags argument of faccessat2 is left undecoded, the same as every other
AT_* entry in the table.
This commit is contained in:
Nexory
2026-08-25 05:17:02 +02:00
parent c4a2631477
commit 935cd6e0b8
1 changed files with 62 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
unotify/syscall_defs.h
View File

@@ -76,6 +76,11 @@ static constexpr SyscallDef kTracedSyscalls[] = {
{__NR_lstat, "newlstat", "lstat", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_lstat */
/* statfs(path, buf) reads filesystem state through a path, like stat above. */
#ifdef __NR_statfs
{__NR_statfs, "statfs", "statfs", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_statfs */
#ifdef __NR_access
{__NR_access, "access", "access", SyscallCategory::FS,
{A::PATH, A::ACCESS, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
@@ -92,6 +97,14 @@ static constexpr SyscallDef kTracedSyscalls[] = {
{__NR_lchown, "lchown", "lchown", SyscallCategory::FS,
{A::PATH, A::UID, A::GID, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_lchown */
/*
* truncate(path, length) writes to a file without opening it, so without
* this entry the content change is not observed at all.
*/
#ifdef __NR_truncate
{__NR_truncate, "truncate", "truncate", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_truncate */
#ifdef __NR_readlink
{__NR_readlink, "readlink", "readlink", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
@@ -125,6 +138,45 @@ static constexpr SyscallDef kTracedSyscalls[] = {
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_chroot */
/*
* Extended attributes are file metadata addressed by path, like chmod and
* chown above. setxattr and removexattr modify a file, getxattr and
* listxattr read it. The l* variants do not follow symlinks, the same
* distinction as stat and lstat.
*/
#ifdef __NR_setxattr
{__NR_setxattr, "setxattr", "setxattr", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_setxattr */
#ifdef __NR_lsetxattr
{__NR_lsetxattr, "lsetxattr", "lsetxattr", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_lsetxattr */
#ifdef __NR_getxattr
{__NR_getxattr, "getxattr", "getxattr", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_getxattr */
#ifdef __NR_lgetxattr
{__NR_lgetxattr, "lgetxattr", "lgetxattr", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_lgetxattr */
#ifdef __NR_listxattr
{__NR_listxattr, "listxattr", "listxattr", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_listxattr */
#ifdef __NR_llistxattr
{__NR_llistxattr, "llistxattr", "llistxattr", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_llistxattr */
#ifdef __NR_removexattr
{__NR_removexattr, "removexattr", "removexattr", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_removexattr */
#ifdef __NR_lremovexattr
{__NR_lremovexattr, "lremovexattr", "lremovexattr", SyscallCategory::FS,
{A::PATH, A::SKIP, A::SKIP, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_lremovexattr */
/* FS - arg0 = dirfd, arg1 = path */
#ifdef __NR_openat
{__NR_openat, "openat", "openat", SyscallCategory::FS,
@@ -152,6 +204,16 @@ static constexpr SyscallDef kTracedSyscalls[] = {
{__NR_faccessat, "faccessat", "faccessat", SyscallCategory::FS,
{A::DIRFD, A::PATH, A::ACCESS, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_faccessat */
/*
* faccessat2(dirfd, path, mode, flags) is what glibc's faccessat() uses on
* modern kernels; it only falls back to faccessat when the kernel lacks it.
* Without this entry an access check made through glibc's faccessat() is
* never observed; a plain access(2) is still traced by its own entry.
*/
#ifdef __NR_faccessat2
{__NR_faccessat2, "faccessat2", "faccessat2", SyscallCategory::FS,
{A::DIRFD, A::PATH, A::ACCESS, A::SKIP, A::SKIP, A::SKIP}},
#endif /* __NR_faccessat2 */
#ifdef __NR_fchmodat
{__NR_fchmodat, "fchmodat", "fchmodat", SyscallCategory::FS,
{A::DIRFD, A::PATH, A::OCTAL, A::SKIP, A::SKIP, A::SKIP}},