From 5f66dc11f51db29a58829c1260263160a54cce11 Mon Sep 17 00:00:00 2001 From: criyle Date: Wed, 13 Aug 2025 22:22:53 +0000 Subject: [PATCH] fix(config): fix syscall check on arm64 --- cmd/runprog/config/config.go | 10 ---------- cmd/runprog/config/config_amd64.go | 16 ++++++++++++++-- cmd/runprog/config/config_arm.go | 9 +++++++++ cmd/runprog/config/config_arm64.go | 8 ++++---- go.mod | 4 ++-- go.sum | 8 ++++---- runner/ptrace/handle_linux.go | 7 +++++-- 7 files changed, 38 insertions(+), 24 deletions(-) diff --git a/cmd/runprog/config/config.go b/cmd/runprog/config/config.go index 8abd7d7..b10513c 100644 --- a/cmd/runprog/config/config.go +++ b/cmd/runprog/config/config.go @@ -32,7 +32,6 @@ var ( "fstat", "lseek", "dup", - "dup2", "dup3", "ioctl", "fcntl", @@ -65,13 +64,10 @@ var ( "exit_group", // others - "arch_prctl", - "gettimeofday", "getrlimit", "getrusage", "times", - "time", "clock_gettime", "restart_syscall", @@ -84,21 +80,15 @@ var ( "execveat", // file open - "open", "openat", // file delete - "unlink", "unlinkat", // soft link - "readlink", "readlinkat", // permission check - "lstat", - "stat", - "access", "faccessat", } diff --git a/cmd/runprog/config/config_amd64.go b/cmd/runprog/config/config_amd64.go index 6bd06f4..da0d8e1 100644 --- a/cmd/runprog/config/config_amd64.go +++ b/cmd/runprog/config/config_amd64.go @@ -8,7 +8,19 @@ var ( "/usr/lib/x86_64-linux-gnu/", } - archSyscallAllows = []string{} + archSyscallAllows = []string{ + "dup2", + "time", + "arch_prctl", + } - archSyscallTraces = []string{} + archSyscallTraces = []string{ + "open", + "unlink", + "readlink", + "lstat", + "stat", + "access", + "newfstatat", + } ) diff --git a/cmd/runprog/config/config_arm.go b/cmd/runprog/config/config_arm.go index c00caec..e3f4726 100644 --- a/cmd/runprog/config/config_arm.go +++ b/cmd/runprog/config/config_arm.go @@ -17,10 +17,19 @@ var ( "uname", "set_tls", "arm_fadvise64_64", + "dup2", } archSyscallTraces = []string{ "lstat64", // 32-bit "stat64", // 32-bit + "open", + "unlink", + "readlink", + "lstat", + "stat", + "access", + "fstatat", + "fstatat64", } ) diff --git a/cmd/runprog/config/config_arm64.go b/cmd/runprog/config/config_arm64.go index 3f3432d..1e54782 100644 --- a/cmd/runprog/config/config_arm64.go +++ b/cmd/runprog/config/config_arm64.go @@ -8,9 +8,9 @@ var ( "/usr/lib/aarch64-linux-gnu/", } - archSyscallAllows = []string{ - "newfstatat", - } + archSyscallAllows = []string{} - archSyscallTraces = []string{} + archSyscallTraces = []string{ + "fstatat", + } ) diff --git a/go.mod b/go.mod index 84f865d..4dd87ee 100644 --- a/go.mod +++ b/go.mod @@ -4,6 +4,6 @@ go 1.24 require ( github.com/elastic/go-seccomp-bpf v1.6.0 - golang.org/x/net v0.41.0 - golang.org/x/sys v0.33.0 + golang.org/x/net v0.43.0 + golang.org/x/sys v0.35.0 ) diff --git a/go.sum b/go.sum index be01736..c0cbe84 100644 --- a/go.sum +++ b/go.sum @@ -6,9 +6,9 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= -golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw= -golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA= -golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw= -golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE= +golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg= +golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI= +golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/runner/ptrace/handle_linux.go b/runner/ptrace/handle_linux.go index 8c47060..3a94a28 100644 --- a/runner/ptrace/handle_linux.go +++ b/runner/ptrace/handle_linux.go @@ -66,11 +66,12 @@ func (h *tracerHandler) Handle(ctx *ptracer.Context) ptracer.TraceAction { return ptracer.TraceKill } + // not checking dirfd for now (maybe unsafe) action := ptracer.TraceKill switch syscallName { case "open": action = h.checkOpen(ctx, ctx.Arg0(), ctx.Arg1()) - case "openat": + case "openat", "openat2": action = h.checkOpen(ctx, ctx.Arg1(), ctx.Arg2()) case "readlink": @@ -85,13 +86,15 @@ func (h *tracerHandler) Handle(ctx *ptracer.Context) ptracer.TraceAction { case "access": action = h.checkStat(ctx, ctx.Arg0()) - case "faccessat", "newfstatat": + case "faccessat", "faccessat2": action = h.checkStat(ctx, ctx.Arg1()) case "stat", "stat64": action = h.checkStat(ctx, ctx.Arg0()) case "lstat", "lstat64": action = h.checkStat(ctx, ctx.Arg0()) + case "statx", "fstatat", "fstatat64", "newfstatat": + action = h.checkStat(ctx, ctx.Arg1()) case "execve": action = h.checkRead(ctx, ctx.Arg0())