DescriptionThis makes the Linux multiprocess crash generation client easier to sandbox with seccomp-bpf when chrooting and namespaces can't be used: if sendmsg and socketpair are both allowed, then the process can send to arbitrary Unix-domain named datagram sockets, which is potentially bad. The filter can't inspect socket-related calls' arguments on 32-bit x86 (see the socketcall(2) man page), which includes the "type" parameter to socketpair(2). Thus, this patch replaces the socket pair with a pipe. This depends on issue 7724002 (although it's possible to adjust the code in question rather than deleting it, if need be). The other socket dependency is that the server sends a single byte to the child with the MSG_DONTWAIT | MSG_NOSIGNAL flags — but the child ignores whether or not that byte was read, so it suffices to simply close the fd and let the child encounter end-of-file. This patch does that. Patch Set 1 #
MessagesTotal messages: 1
|