GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 16:57:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Make seccomp failures non-fatal & lower log prio

Browse Source 
Building a binary with --enable-seccomp and then running it on a < 3.5
kernel, results in seccomp_load() failing and ocserv's worker process
aborting. This might be okay-ish for users who ./configure && make
install on their own systems but it's obviously non-ideal for e.g.
distributions that need to distribute binaries.

Unfortunately there doesn't seem to be a good way (that I could find) to
check if the running kernel has seccomp -- uname/uts isn't a good
solution as Ubuntu has backported it to 3.2, custom kernels might have
CONFIG_SECCOMP=n etc.

So, this makes a tradeoff call and removes the exit_worker() call on
seccomp failures, lowers the seccomp error logs to LOG_DEBUG from
LOG_WARNING and the "could not disable system calls" to LOG_INFO from
LOG_ERR.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
This commit is contained in:
Faidon Liambotis
2013-05-16 17:16:36 +03:00
committed by Nikos Mavrogiannopoulos
parent 3bfbe1a371
commit 3071bda08a
2 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/worker-privs.c
View File

@@ -31,7 +31,7 @@ int disable_system_calls(struct worker_st *ws)
ctx = seccomp_init(SCMP_ACT_KILL);
if (ctx == NULL) {
oclog(ws, LOG_WARNING, "could not initialize seccomp");
oclog(ws, LOG_DEBUG, "could not initialize seccomp");
return -1;
}
@@ -39,7 +39,7 @@ int disable_system_calls(struct worker_st *ws)
ret = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(name), 0); \
/* libseccomp returns EDOM for pseudo-syscalls due to a bug */ \
if (ret < 0 && ret != -EDOM) { \
oclog(ws, LOG_WARNING, "could not add " #name " to seccomp filter: %s", strerror(-ret)); \
oclog(ws, LOG_DEBUG, "could not add " #name " to seccomp filter: %s", strerror(-ret)); \
ret = -1; \
goto fail; \
}
@@ -66,7 +66,7 @@ int disable_system_calls(struct worker_st *ws)
ret = seccomp_load(ctx);
if (ret < 0) {
oclog(ws, LOG_ERR, "could not load seccomp filter");
oclog(ws, LOG_DEBUG, "could not load seccomp filter");
ret = -1;
goto fail;
}

3
src/worker-vpn.c
View File

@@ -490,8 +490,7 @@ void vpn_server(struct worker_st* ws)
ret = disable_system_calls(ws);
if (ret < 0) {
oclog(ws, LOG_ERR, "could not disable system calls (seccomp error)");
exit_worker(ws);
oclog(ws, LOG_INFO, "could not disable system calls, kernel might not support seccomp");
}
oclog(ws, LOG_INFO, "accepted connection");