DWS/chrony
1
0
Fork 0
mirror of https://gitlab.com/chrony/chrony.git synced 2026-03-11 00:59:38 -04:00
Code Issues Packages Projects Releases Wiki Activity

privops: enable system call filter

Browse Source 
In preparation of OpenBSD support, add SYS_EnableSystemCallFilter() call
to PRV_StartHelper().

In OpenBSD the privops helper will use a system call filter (pledge(2)),
whereas in Linux the privops helper doesn't use any system call filter
at the moment.

Modify Unit test ntp_sources call to PRV_Initialise() with parameter
scfilter_level set to 0.
This commit is contained in:
Thomas Kupper
2026-02-11 07:53:41 +01:00
committed by Miroslav Lichvar
parent cda67351ae
commit fd60dabde7
6 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
main.c
View File

@@ -650,7 +650,7 @@ int main
/* Write our pidfile to prevent other instances from running */ /* Write our pidfile to prevent other instances from running */
write_pidfile(); write_pidfile();
PRV_Initialise(); PRV_Initialise(scfilter_level);
LCL_Initialise(); LCL_Initialise();
SCH_Initialise(); SCH_Initialise();
SCK_Initialise(address_family); SCK_Initialise(address_family);

8
privops.c
View File

@@ -34,6 +34,7 @@
#include "logging.h" #include "logging.h"
#include "privops.h" #include "privops.h"
#include "socket.h" #include "socket.h"
#include "sys.h"
#include "util.h" #include "util.h"
#define OP_ADJUSTTIME 1024 #define OP_ADJUSTTIME 1024
@@ -131,6 +132,7 @@ typedef struct {
static int helper_fd; static int helper_fd;
static pid_t helper_pid; static pid_t helper_pid;
static int scfilter_level;
static int static int
have_helper(void) have_helper(void)
@@ -624,9 +626,10 @@ PRV_ReloadDNS(void)
/* ======================================================================= */ /* ======================================================================= */
void void
PRV_Initialise(void) PRV_Initialise(int level)
{ {
helper_fd = -1; helper_fd = -1;
scfilter_level = level;
} }
/* ======================================================================= */ /* ======================================================================= */
@@ -667,6 +670,9 @@ PRV_StartHelper(void)
/* ignore signals, the process will exit on OP_QUIT request */ /* ignore signals, the process will exit on OP_QUIT request */
UTI_SetQuitSignalsHandler(SIG_IGN, 1); UTI_SetQuitSignalsHandler(SIG_IGN, 1);
if (scfilter_level != 0)
SYS_EnableSystemCallFilter(scfilter_level, SYS_PRIVOPS_HELPER);
helper_main(sock_fd2); helper_main(sock_fd2);
} else { } else {

4
privops.h
View File

@@ -65,11 +65,11 @@ void PRV_ReloadDNS(void);
#endif #endif
#ifdef PRIVOPS_HELPER #ifdef PRIVOPS_HELPER
void PRV_Initialise(void); void PRV_Initialise(int scfilter_level);
void PRV_StartHelper(void); void PRV_StartHelper(void);
void PRV_Finalise(void); void PRV_Finalise(void);
#else #else
#define PRV_Initialise() #define PRV_Initialise(scfilter_level)
#define PRV_StartHelper() #define PRV_StartHelper()
#define PRV_Finalise() #define PRV_Finalise()
#endif #endif

1
sys.h
View File

@@ -38,6 +38,7 @@ extern void SYS_Finalise(void);
typedef enum { typedef enum {
SYS_MAIN_PROCESS, SYS_MAIN_PROCESS,
SYS_NTSKE_HELPER, SYS_NTSKE_HELPER,
SYS_PRIVOPS_HELPER,
} SYS_ProcessContext; } SYS_ProcessContext;
/* Switch to the specified user and group in given context */ /* Switch to the specified user and group in given context */

3
sys_linux.c
View File

@@ -658,6 +658,9 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
modules are installed and enabled on the system). */ modules are installed and enabled on the system). */
if (default_action != SCMP_ACT_ALLOW) if (default_action != SCMP_ACT_ALLOW)
PRV_StartHelper(); PRV_StartHelper();
} else if (context == SYS_PRIVOPS_HELPER) {
/* The privops helper on Linux doesn't have any filter loaded */
return;
} }
ctx = seccomp_init(default_action); ctx = seccomp_init(default_action);

2
test/unit/ntp_sources.c
View File

@@ -137,7 +137,7 @@ test_unit(void)
CNF_Initialise(0, 0); CNF_Initialise(0, 0);
CNF_ParseLine(NULL, 1, conf); CNF_ParseLine(NULL, 1, conf);
PRV_Initialise(); PRV_Initialise(0);
LCL_Initialise(); LCL_Initialise();
TST_RegisterDummyDrivers(); TST_RegisterDummyDrivers();
SCH_Initialise(); SCH_Initialise();