Browse Source

seccomp: add futex_requeue syscall (kernel v6.7, libseccomp v2.5.5)

Add this syscall to match the profile in containerd

containerd: https://github.com/containerd/containerd/commit/a6e52c74fa043a63d7dae4ac6998215f6c1bb6ac
libseccomp: https://github.com/seccomp/libseccomp/commit/53267af3fb56eed93a50b8ef92f41825c97a7813
kernel: https://github.com/torvalds/linux/commit/0f4b5f972216782a4acb1ae00dcb55173847c2ff

    futex: Add sys_futex_requeue()

    Finish off the 'simple' futex2 syscall group by adding
    sys_futex_requeue(). Unlike sys_futex_{wait,wake}() its arguments are
    too numerous to fit into a regular syscall. As such, use struct
    futex_waitv to pass the 'source' and 'destination' futexes to the
    syscall.

    This syscall implements what was previously known as FUTEX_CMP_REQUEUE
    and uses {val, uaddr, flags} for source and {uaddr, flags} for
    destination.

    This design explicitly allows requeueing between different types of
    futex by having a different flags word per uaddr.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit df57a080b68bf3096041b1c95ffbb0504b2cf167)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn 1 năm trước cách đây
mục cha
commit
4cc0416534

+ 1 - 0
profiles/seccomp/default.json

@@ -132,6 +132,7 @@
 				"ftruncate",
 				"ftruncate",
 				"ftruncate64",
 				"ftruncate64",
 				"futex",
 				"futex",
+				"futex_requeue",
 				"futex_time64",
 				"futex_time64",
 				"futex_waitv",
 				"futex_waitv",
 				"futimesat",
 				"futimesat",

+ 1 - 0
profiles/seccomp/default_linux.go

@@ -124,6 +124,7 @@ func DefaultProfile() *Seccomp {
 					"ftruncate",
 					"ftruncate",
 					"ftruncate64",
 					"ftruncate64",
 					"futex",
 					"futex",
+					"futex_requeue", // kernel v6.7, libseccomp v2.5.5
 					"futex_time64",
 					"futex_time64",
 					"futex_waitv",
 					"futex_waitv",
 					"futimesat",
 					"futimesat",