From dbbb7a83b64d3707a903d6c5a657ee168346f0c6 Mon Sep 17 00:00:00 2001 From: Alois Wohlschlager Date: Mon, 1 Jul 2024 09:18:01 +0200 Subject: [PATCH] libstore/build: block io_uring Unfortunately, io_uring is totally opaque to seccomp, and while currently there are no dangerous operations implemented, there is no guarantee that it remains this way. This means that io_uring should be blocked entirely to ensure that the sandbox is future-proof. This has not been observed to cause issues in practice. Change-Id: I45d3895f95abe1bc103a63969f444c334dbbf50d --- src/libstore/build/local-derivation-goal.cc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc index 17f0765f5..d04c9a94a 100644 --- a/src/libstore/build/local-derivation-goal.cc +++ b/src/libstore/build/local-derivation-goal.cc @@ -1588,9 +1588,9 @@ void setupSeccomp() allowSyscall(ctx, SCMP_SYS(ioprio_set)); allowSyscall(ctx, SCMP_SYS(io_setup)); allowSyscall(ctx, SCMP_SYS(io_submit)); - allowSyscall(ctx, SCMP_SYS(io_uring_enter)); - allowSyscall(ctx, SCMP_SYS(io_uring_register)); - allowSyscall(ctx, SCMP_SYS(io_uring_setup)); + // skip io_uring_enter (may become dangerous) + // skip io_uring_register (may become dangerous) + // skip io_uring_setup (may become dangerous) allowSyscall(ctx, SCMP_SYS(ipc)); allowSyscall(ctx, SCMP_SYS(kcmp)); allowSyscall(ctx, SCMP_SYS(kexec_file_load));