diff options
| author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2022-01-07 15:23:55 +0100 |
|---|---|---|
| committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2022-01-07 17:41:17 +0100 |
| commit | d08f6ff204c8525f7533875128468afb8be60ae0 (patch) | |
| tree | 712dbdf09d7d25bcfb0c2673fcb4f5dfacfba2c1 | |
| parent | 7dbfdefca31b2035e7c871f4e866442158429213 (diff) | |
| download | systemd-d08f6ff204c8525f7533875128468afb8be60ae0.tar.gz | |
seccomp: move arch_prctl to @default
It was reported as used by the linker:
> [It is] called in the setup of ld-linux-x86-64.so.2 from _dl_sysdep_start.
> My local call stack (with LTO):
>
> #0 init_cpu_features.constprop.0 (/usr/lib64/ld-linux-x86-64.so.2)
> #1 _dl_sysdep_start (/usr/lib64/ld-linux-x86-64.so.2)
> #2 _dl_start (/usr/lib64/ld-linux-x86-64.so.2)
> #3 _start (/usr/lib64/ld-linux-x86-64.so.2)
>
> Looking through the source, I think it's this (links for glibc 2.34):
> - First dl_platform_init calls _dl_x86_init_cpu_features, a wrapper for init_cpu_features.
> - Then init_cpu_features calls get_cet_status.
> - At last, get_cet_status invokes arch_prctl.
Fixes #22033.
(cherry picked from commit 5f02870a74aa3a758115cc9bd6d68f239caf8453)
| -rw-r--r-- | src/shared/seccomp-util.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index b70ad1f7ea..32bd8aa73b 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -286,6 +286,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { .name = "@default", .help = "System calls that are always permitted", .value = + "arch_prctl\0" /* Used during platform-specific initialization by ld-linux.so. */ "brk\0" "cacheflush\0" "clock_getres\0" @@ -715,7 +716,6 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { .name = "@process", .help = "Process control, execution, namespacing operations", .value = - "arch_prctl\0" "capget\0" /* Able to query arbitrary processes */ "clone\0" "clone3\0" |