The package rpms/libseccomp.git has added or updated architecture specific content in its
spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s):
https://src.fedoraproject.org/cgit/rpms/libseccomp.git/commit/?id=529c957....
Change:
-%ifarch i686 ppc64le s390x
Thanks.
Full change:
============
commit 5e8deb83a0c85b2d8a2400cd467e3949f8ef3de4
Author: Debarshi Ray <debarshir(a)gnome.org>
Date: Wed Nov 3 12:06:12 2021 +0100
New upstream version (#1900097)
diff --git a/.gitignore b/.gitignore
index 54770ea..6c46772 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,4 @@
/libseccomp-2.4.2.tar.gz
/libseccomp-2.5.0.tar.gz
/libseccomp-2.5.1.tar.gz
+/libseccomp-2.5.2.tar.gz
diff --git a/libseccomp.spec b/libseccomp.spec
index 04e7081..7c13843 100644
--- a/libseccomp.spec
+++ b/libseccomp.spec
@@ -1,5 +1,5 @@
Name: libseccomp
-Version: 2.5.1
+Version: 2.5.2
Release: 1%{?dist}
Summary: Enhanced seccomp library
License: LGPLv2
@@ -83,6 +83,9 @@ rm -f %{buildroot}/%{_libdir}/libseccomp.la
%{_libdir}/libseccomp.a
%changelog
+* Wed Nov 03 2021 Debarshi Ray <rishi(a)fedoraproject.org> - 2.5.2-1
+- New upstream version (#1900097)
+
* Wed Nov 03 2021 Debarshi Ray <rishi(a)fedoraproject.org> - 2.5.1-1
- New upstream version (#1900097)
diff --git a/sources b/sources
index 27d4059..936b0f5 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (libseccomp-2.5.1.tar.gz) =
2be80a6323f9282dbeae8791724e5778b32e2382b2a3d1b0f77366371ec4072ea28128204f675cce101c091c0420d12c497e1a9ccbb7dc5bcbf61bfd777160af
+SHA512 (libseccomp-2.5.2.tar.gz) =
b2a95152cb274d6b35753596fd825406dae20c4a48b2f4076f835f977ecf324de38a3fe02e789dc20b49ecf6b4eb67f03e7733e92d40f5e20f25874307f1c2ac
commit 43b0412403c480995b6da3ee45cf2744830f6251
Author: Debarshi Ray <debarshir(a)gnome.org>
Date: Wed Nov 3 12:06:52 2021 +0100
Drop upstreamed patches
Fallout from 529c95767dc1b6ca1e73c4bf8c5c8b2734d2e0c8
diff --git a/0101-all-only-request-the-userspace-notification-fd-once.patch
b/0101-all-only-request-the-userspace-notification-fd-once.patch
deleted file mode 100644
index 59f412e..0000000
--- a/0101-all-only-request-the-userspace-notification-fd-once.patch
+++ /dev/null
@@ -1,631 +0,0 @@
-From bbf4ae95742662e641e0a456951b912024433435 Mon Sep 17 00:00:00 2001
-From: Paul Moore <paul(a)paul-moore.com>
-Date: Sun, 26 Jul 2020 11:01:49 -0400
-Subject: [PATCH 101/102] all: only request the userspace notification fd once
-
-It turns out that requesting the seccomp userspace notifcation fd
-more than once is a bad thing which causes the kernel to complain
-(rightfully so for a variety of reasons). Unfortunately as we were
-always requesting the notification fd whenever possible this results
-in problems at filter load time.
-
-Our solution is to move the notification fd out of the filter context
-and into the global task context, using a newly created task_state
-structure. This allows us to store, and retrieve the notification
-outside the scope of an individual filter context. It also provides
-some implementation improvements by giving us a convenient place to
-stash all of the API level related support variables. We also extend
-the seccomp_reset() API call to reset this internal global state when
-passed a NULL filter context.
-
-There is one potential case which we don't currently handle well:
-threads. At the moment libseccomp is thread ignorant, and that works
-well as the only global state up to this point was the currently
-supported API level information which was common to all threads in a
-process. Unfortunately, it appears that the notification fd need not
-be common to all threads in a process, yet this patch treats it as if
-it is common. I suspect this is a very unusual use case so I decided
-to keep this patch simple and ignore this case, but in the future if
-we need to support this properly we should be able to do so without
-API changes by keeping an internal list of notification fds indexed
-by gettid(2).
-
-This fixes the GitHub issue below:
-*
https://github.com/seccomp/libseccomp/issues/273
-
-Reported-by: Tobias Stoeckmann <tobias(a)stoeckmann.org>
-Acked-by: Tom Hromatka <tom.hromatka(a)oracle.com>
-Signed-off-by: Paul Moore <paul(a)paul-moore.com>
----
- doc/man/man3/seccomp_init.3 | 10 +-
- doc/man/man3/seccomp_notify_alloc.3 | 3 +-
- src/api.c | 19 ++-
- src/db.c | 1 -
- src/db.h | 3 +-
- src/system.c | 204 ++++++++++++++++++----------
- src/system.h | 3 +
- tests/11-basic-basic_errors.c | 9 +-
- tests/51-live-user_notification.c | 21 +++
- tests/51-live-user_notification.py | 4 +
- 10 files changed, 187 insertions(+), 90 deletions(-)
-
-diff --git a/doc/man/man3/seccomp_init.3 b/doc/man/man3/seccomp_init.3
-index 3ab68fe..87520cd 100644
---- a/doc/man/man3/seccomp_init.3
-+++ b/doc/man/man3/seccomp_init.3
-@@ -36,7 +36,15 @@ The
- function releases the existing filter context state before reinitializing it
- and can only be called after a call to
- .BR seccomp_init ()
--has succeeded.
-+has succeeded. If
-+.BR seccomp_reset ()
-+is called with a NULL filter, it resets the library's global task state;
-+normally this is not needed, but it may be required to continue using the
-+library after a
-+.BR fork ()
-+or
-+.BR clone ()
-+call to ensure the API level and user notification state is properly reset.
- .P
- When the caller is finished configuring the seccomp filter and has loaded it
- into the kernel, the caller should call
-diff --git a/doc/man/man3/seccomp_notify_alloc.3 b/doc/man/man3/seccomp_notify_alloc.3
-index 50c8970..cb1c048 100644
---- a/doc/man/man3/seccomp_notify_alloc.3
-+++ b/doc/man/man3/seccomp_notify_alloc.3
-@@ -59,7 +59,8 @@ returns the notification fd of a filter after it has been loaded.
- .\" //////////////////////////////////////////////////////////////////////////
- The
- .BR seccomp_notify_fd ()
--returns the notification fd of the loaded filter.
-+returns the notification fd of the loaded filter, -1 if a notification fd has
-+not yet been created, and -EINVAL if the filter context is invalid.
- .P
- The
- .BR seccomp_notify_id_valid ()
-diff --git a/src/api.c b/src/api.c
-index 00975ad..5cec088 100644
---- a/src/api.c
-+++ b/src/api.c
-@@ -301,10 +301,18 @@ API int seccomp_reset(scmp_filter_ctx ctx, uint32_t def_action)
- {
- struct db_filter_col *col = (struct db_filter_col *)ctx;
-
-- /* use a NULL filter collection here since we are resetting it */
-- if (ctx == NULL || db_col_action_valid(NULL, def_action) < 0)
-+ /* a NULL filter context indicates we are resetting the global state */
-+ if (ctx == NULL) {
-+ /* reset the global state and redetermine the api level */
-+ sys_reset_state();
-+ _seccomp_api_update();
-+ return _rc_filter(0);
-+ }
-+ /* ensure the default action is valid */
-+ if (db_col_action_valid(NULL, def_action) < 0)
- return _rc_filter(-EINVAL);
-
-+ /* reset the filter */
- return _rc_filter(db_col_reset(col, def_action));
- }
-
-@@ -675,16 +683,17 @@ API int seccomp_notify_id_valid(int fd, uint64_t id)
- /* NOTE - function header comment in include/seccomp.h */
- API int seccomp_notify_fd(const scmp_filter_ctx ctx)
- {
-- struct db_filter_col *col;
-+ /* NOTE: for historical reasons, and possibly future use, we require a
-+ * valid filter context even though we don't actual use it here; the
-+ * api update is also not strictly necessary, but keep it for now */
-
- /* force a runtime api level detection */
- _seccomp_api_update();
-
- if (_ctx_valid(ctx))
- return _rc_filter(-EINVAL);
-- col = (struct db_filter_col *)ctx;
-
-- return _rc_filter(col->notify_fd);
-+ return _rc_filter(sys_notify_fd());
- }
-
- /* NOTE - function header comment in include/seccomp.h */
-diff --git a/src/db.c b/src/db.c
-index 4a87ea3..836171a 100644
---- a/src/db.c
-+++ b/src/db.c
-@@ -1057,7 +1057,6 @@ int db_col_reset(struct db_filter_col *col, uint32_t def_action)
- if (col->filters)
- free(col->filters);
- col->filters = NULL;
-- col->notify_fd = -1;
-
- /* set the endianess to undefined */
- col->endian = 0;
-diff --git a/src/db.h b/src/db.h
-index b96b104..765c607 100644
---- a/src/db.h
-+++ b/src/db.h
-@@ -160,8 +160,7 @@ struct db_filter_col {
- /* transaction snapshots */
- struct db_filter_snap *snapshots;
-
-- /* notification fd that was returned from seccomp() */
-- int notify_fd;
-+ /* userspace notification */
- bool notify_used;
- };
-
-diff --git a/src/system.c b/src/system.c
-index 6cdfc16..3b43b2a 100644
---- a/src/system.c
-+++ b/src/system.c
-@@ -40,16 +40,61 @@
- * our next release we may have to enable the allowlist */
- #define SYSCALL_ALLOWLIST_ENABLE 0
-
--static int _nr_seccomp = -1;
--static int _support_seccomp_syscall = -1;
--static int _support_seccomp_flag_tsync = -1;
--static int _support_seccomp_flag_log = -1;
--static int _support_seccomp_action_log = -1;
--static int _support_seccomp_kill_process = -1;
--static int _support_seccomp_flag_spec_allow = -1;
--static int _support_seccomp_flag_new_listener = -1;
--static int _support_seccomp_user_notif = -1;
--static int _support_seccomp_flag_tsync_esrch = -1;
-+/* task global state */
-+struct task_state {
-+ /* seccomp(2) syscall */
-+ int nr_seccomp;
-+
-+ /* userspace notification fd */
-+ int notify_fd;
-+
-+ /* runtime support flags */
-+ int sup_syscall;
-+ int sup_flag_tsync;
-+ int sup_flag_log;
-+ int sup_action_log;
-+ int sup_kill_process;
-+ int sup_flag_spec_allow;
-+ int sup_flag_new_listener;
-+ int sup_user_notif;
-+ int sup_flag_tsync_esrch;
-+};
-+static struct task_state state = {
-+ .nr_seccomp = -1,
-+
-+ .notify_fd = -1,
-+
-+ .sup_syscall = -1,
-+ .sup_flag_tsync = -1,
-+ .sup_flag_log = -1,
-+ .sup_action_log = -1,
-+ .sup_kill_process = -1,
-+ .sup_flag_spec_allow = -1,
-+ .sup_flag_new_listener = -1,
-+ .sup_user_notif = -1,
-+ .sup_flag_tsync_esrch = -1,
-+};
-+
-+/**
-+ * Reset the task state
-+ *
-+ * This function fully resets the library's global "system task state".
-+ *
-+ */
-+void sys_reset_state(void)
-+{
-+ state.nr_seccomp = -1;
-+ state.notify_fd = -1;
-+ state.sup_syscall = -1;
-+ state.sup_flag_tsync = -1;
-+ state.sup_flag_log = -1;
-+ state.sup_action_log = -1;
-+ state.sup_kill_process = -1;
-+ state.sup_flag_spec_allow = -1;
-+ state.sup_flag_new_listener = -1;
-+ state.sup_user_notif = -1;
-+ state.sup_flag_tsync_esrch = -1;
-+}
-
- /**
- * Check to see if the seccomp() syscall is supported
-@@ -68,8 +113,8 @@ int sys_chk_seccomp_syscall(void)
- /* NOTE: it is reasonably safe to assume that we should be able to call
- * seccomp() when the caller first starts, but we can't rely on
- * it later so we need to cache our findings for use later */
-- if (_support_seccomp_syscall >= 0)
-- return _support_seccomp_syscall;
-+ if (state.sup_syscall >= 0)
-+ return state.sup_syscall;
-
- #if SYSCALL_ALLOWLIST_ENABLE
- /* architecture allowlist */
-@@ -100,11 +145,11 @@ int sys_chk_seccomp_syscall(void)
- goto supported;
-
- unsupported:
-- _support_seccomp_syscall = 0;
-+ state.sup_syscall = 0;
- return 0;
- supported:
-- _nr_seccomp = nr_seccomp;
-- _support_seccomp_syscall = 1;
-+ state.nr_seccomp = nr_seccomp;
-+ state.sup_syscall = 1;
- return 1;
- }
-
-@@ -118,7 +163,7 @@ supported:
- */
- void sys_set_seccomp_syscall(bool enable)
- {
-- _support_seccomp_syscall = (enable ? 1 : 0);
-+ state.sup_syscall = (enable ? 1 : 0);
- }
-
- /**
-@@ -132,16 +177,16 @@ void sys_set_seccomp_syscall(bool enable)
- int sys_chk_seccomp_action(uint32_t action)
- {
- if (action == SCMP_ACT_KILL_PROCESS) {
-- if (_support_seccomp_kill_process < 0) {
-+ if (state.sup_kill_process < 0) {
- if (sys_chk_seccomp_syscall() == 1 &&
-- syscall(_nr_seccomp, SECCOMP_GET_ACTION_AVAIL, 0,
-- &action) == 0)
-- _support_seccomp_kill_process = 1;
-+ syscall(state.nr_seccomp,
-+ SECCOMP_GET_ACTION_AVAIL, 0, &action) == 0)
-+ state.sup_kill_process = 1;
- else
-- _support_seccomp_kill_process = 0;
-+ state.sup_kill_process = 0;
- }
-
-- return _support_seccomp_kill_process;
-+ return state.sup_kill_process;
- } else if (action == SCMP_ACT_KILL_THREAD) {
- return 1;
- } else if (action == SCMP_ACT_TRAP) {
-@@ -152,30 +197,30 @@ int sys_chk_seccomp_action(uint32_t action)
- } else if (action == SCMP_ACT_TRACE(action & 0x0000ffff)) {
- return 1;
- } else if (action == SCMP_ACT_LOG) {
-- if (_support_seccomp_action_log < 0) {
-+ if (state.sup_action_log < 0) {
- if (sys_chk_seccomp_syscall() == 1 &&
-- syscall(_nr_seccomp, SECCOMP_GET_ACTION_AVAIL, 0,
-- &action) == 0)
-- _support_seccomp_action_log = 1;
-+ syscall(state.nr_seccomp,
-+ SECCOMP_GET_ACTION_AVAIL, 0, &action) == 0)
-+ state.sup_action_log = 1;
- else
-- _support_seccomp_action_log = 0;
-+ state.sup_action_log = 0;
- }
-
-- return _support_seccomp_action_log;
-+ return state.sup_action_log;
- } else if (action == SCMP_ACT_ALLOW) {
- return 1;
- } else if (action == SCMP_ACT_NOTIFY) {
-- if (_support_seccomp_user_notif < 0) {
-+ if (state.sup_user_notif < 0) {
- struct seccomp_notif_sizes sizes;
- if (sys_chk_seccomp_syscall() == 1 &&
-- syscall(_nr_seccomp, SECCOMP_GET_NOTIF_SIZES, 0,
-- &sizes) == 0)
-- _support_seccomp_user_notif = 1;
-+ syscall(state.nr_seccomp,
-+ SECCOMP_GET_NOTIF_SIZES, 0, &sizes) == 0)
-+ state.sup_user_notif = 1;
- else
-- _support_seccomp_user_notif = 0;
-+ state.sup_user_notif = 0;
- }
-
-- return _support_seccomp_user_notif;
-+ return state.sup_user_notif;
- }
-
- return 0;
-@@ -193,13 +238,13 @@ void sys_set_seccomp_action(uint32_t action, bool enable)
- {
- switch (action) {
- case SCMP_ACT_LOG:
-- _support_seccomp_action_log = (enable ? 1 : 0);
-+ state.sup_action_log = (enable ? 1 : 0);
- break;
- case SCMP_ACT_KILL_PROCESS:
-- _support_seccomp_kill_process = (enable ? 1 : 0);
-+ state.sup_kill_process = (enable ? 1 : 0);
- break;
- case SCMP_ACT_NOTIFY:
-- _support_seccomp_user_notif = (enable ? 1 : 0);
-+ state.sup_user_notif = (enable ? 1 : 0);
- break;
- }
- }
-@@ -212,13 +257,14 @@ void sys_set_seccomp_action(uint32_t action, bool enable)
- * Return one if the flag is supported, zero otherwise.
- *
- */
--static int _sys_chk_seccomp_flag_kernel(int flag)
-+static int _sys_chk_flag_kernel(int flag)
- {
- /* this is an invalid seccomp(2) call because the last argument
- * is NULL, but depending on the errno value of EFAULT we can
- * guess if the filter flag is supported or not */
- if (sys_chk_seccomp_syscall() == 1 &&
-- syscall(_nr_seccomp, SECCOMP_SET_MODE_FILTER, flag, NULL) == -1 &&
-+ syscall(state.nr_seccomp,
-+ SECCOMP_SET_MODE_FILTER, flag, NULL) == -1 &&
- errno == EFAULT)
- return 1;
-
-@@ -238,29 +284,25 @@ int sys_chk_seccomp_flag(int flag)
- {
- switch (flag) {
- case SECCOMP_FILTER_FLAG_TSYNC:
-- if (_support_seccomp_flag_tsync < 0)
-- _support_seccomp_flag_tsync = _sys_chk_seccomp_flag_kernel(flag);
--
-- return _support_seccomp_flag_tsync;
-+ if (state.sup_flag_tsync < 0)
-+ state.sup_flag_tsync = _sys_chk_flag_kernel(flag);
-+ return state.sup_flag_tsync;
- case SECCOMP_FILTER_FLAG_LOG:
-- if (_support_seccomp_flag_log < 0)
-- _support_seccomp_flag_log = _sys_chk_seccomp_flag_kernel(flag);
--
-- return _support_seccomp_flag_log;
-+ if (state.sup_flag_log < 0)
-+ state.sup_flag_log = _sys_chk_flag_kernel(flag);
-+ return state.sup_flag_log;
- case SECCOMP_FILTER_FLAG_SPEC_ALLOW:
-- if (_support_seccomp_flag_spec_allow < 0)
-- _support_seccomp_flag_spec_allow = _sys_chk_seccomp_flag_kernel(flag);
--
-- return _support_seccomp_flag_spec_allow;
-+ if (state.sup_flag_spec_allow < 0)
-+ state.sup_flag_spec_allow = _sys_chk_flag_kernel(flag);
-+ return state.sup_flag_spec_allow;
- case SECCOMP_FILTER_FLAG_NEW_LISTENER:
-- if (_support_seccomp_flag_new_listener < 0)
-- _support_seccomp_flag_new_listener = _sys_chk_seccomp_flag_kernel(flag);
--
-- return _support_seccomp_flag_new_listener;
-+ if (state.sup_flag_new_listener < 0)
-+ state.sup_flag_new_listener = _sys_chk_flag_kernel(flag);
-+ return state.sup_flag_new_listener;
- case SECCOMP_FILTER_FLAG_TSYNC_ESRCH:
-- if (_support_seccomp_flag_tsync_esrch < 0)
-- _support_seccomp_flag_tsync_esrch = _sys_chk_seccomp_flag_kernel(flag);
-- return _support_seccomp_flag_tsync_esrch;
-+ if (state.sup_flag_tsync_esrch < 0)
-+ state.sup_flag_tsync_esrch = _sys_chk_flag_kernel(flag);
-+ return state.sup_flag_tsync_esrch;
- }
-
- return -EOPNOTSUPP;
-@@ -279,19 +321,19 @@ void sys_set_seccomp_flag(int flag, bool enable)
- {
- switch (flag) {
- case SECCOMP_FILTER_FLAG_TSYNC:
-- _support_seccomp_flag_tsync = (enable ? 1 : 0);
-+ state.sup_flag_tsync = (enable ? 1 : 0);
- break;
- case SECCOMP_FILTER_FLAG_LOG:
-- _support_seccomp_flag_log = (enable ? 1 : 0);
-+ state.sup_flag_log = (enable ? 1 : 0);
- break;
- case SECCOMP_FILTER_FLAG_SPEC_ALLOW:
-- _support_seccomp_flag_spec_allow = (enable ? 1 : 0);
-+ state.sup_flag_spec_allow = (enable ? 1 : 0);
- break;
- case SECCOMP_FILTER_FLAG_NEW_LISTENER:
-- _support_seccomp_flag_new_listener = (enable ? 1 : 0);
-+ state.sup_flag_new_listener = (enable ? 1 : 0);
- break;
- case SECCOMP_FILTER_FLAG_TSYNC_ESRCH:
-- _support_seccomp_flag_tsync_esrch = (enable ? 1 : 0);
-+ state.sup_flag_tsync_esrch = (enable ? 1 : 0);
- break;
- }
- }
-@@ -324,7 +366,7 @@ int sys_filter_load(struct db_filter_col *col, bool rawrc)
- goto filter_load_out;
- }
-
-- tsync_notify = (_support_seccomp_flag_tsync_esrch > 0);
-+ tsync_notify = state.sup_flag_tsync_esrch > 0 && state.notify_fd == -1;
-
- /* load the filter into the kernel */
- if (sys_chk_seccomp_syscall() == 1) {
-@@ -333,28 +375,29 @@ int sys_filter_load(struct db_filter_col *col, bool rawrc)
- if (col->attr.tsync_enable)
- flgs |= SECCOMP_FILTER_FLAG_TSYNC | \
- SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
-- if (_support_seccomp_user_notif > 0)
-+ if (state.sup_user_notif > 0)
- flgs |= SECCOMP_FILTER_FLAG_NEW_LISTENER;
- } else if (col->attr.tsync_enable)
- flgs |= SECCOMP_FILTER_FLAG_TSYNC;
-- else if (_support_seccomp_user_notif > 0)
-+ else if (state.sup_user_notif > 0 && state.notify_fd == -1)
- flgs |= SECCOMP_FILTER_FLAG_NEW_LISTENER;
- if (col->attr.log_enable)
- flgs |= SECCOMP_FILTER_FLAG_LOG;
- if (col->attr.spec_allow)
- flgs |= SECCOMP_FILTER_FLAG_SPEC_ALLOW;
-- rc = syscall(_nr_seccomp, SECCOMP_SET_MODE_FILTER, flgs, prgm);
-+ rc = syscall(state.nr_seccomp,
-+ SECCOMP_SET_MODE_FILTER, flgs, prgm);
- if (tsync_notify && rc > 0) {
- /* return 0 on NEW_LISTENER success, but save the fd */
-- col->notify_fd = rc;
-+ state.notify_fd = rc;
- rc = 0;
- } else if (rc > 0 && col->attr.tsync_enable) {
- /* always return -ESRCH if we fail to sync threads */
- errno = ESRCH;
- rc = -errno;
-- } else if (rc > 0 && _support_seccomp_user_notif > 0) {
-+ } else if (rc > 0 && state.sup_user_notif > 0) {
- /* return 0 on NEW_LISTENER success, but save the fd */
-- col->notify_fd = rc;
-+ state.notify_fd = rc;
- rc = 0;
- }
- } else
-@@ -370,6 +413,19 @@ filter_load_out:
- return rc;
- }
-
-+/**
-+ * Return the userspace notification fd
-+ *
-+ * This function returns the userspace notification fd from
-+ * SECCOMP_FILTER_FLAG_NEW_LISTENER. If the notification fd has not yet been
-+ * set, or an error has occurred, -1 is returned.
-+ *
-+ */
-+int sys_notify_fd(void)
-+{
-+ return state.notify_fd;
-+}
-+
- /**
- * Allocate a pair of notification request/response structures
- * @param req the request location
-@@ -386,7 +442,7 @@ int sys_notify_alloc(struct seccomp_notif **req,
- int rc;
- static struct seccomp_notif_sizes sizes = { 0, 0, 0 };
-
-- if (_support_seccomp_syscall <= 0)
-+ if (state.sup_syscall <= 0)
- return -EOPNOTSUPP;
-
- if (sizes.seccomp_notif == 0 && sizes.seccomp_notif_resp == 0) {
-@@ -427,7 +483,7 @@ int sys_notify_alloc(struct seccomp_notif **req,
- */
- int sys_notify_receive(int fd, struct seccomp_notif *req)
- {
-- if (_support_seccomp_user_notif <= 0)
-+ if (state.sup_user_notif <= 0)
- return -EOPNOTSUPP;
-
- if (ioctl(fd, SECCOMP_IOCTL_NOTIF_RECV, req) < 0)
-@@ -448,7 +504,7 @@ int sys_notify_receive(int fd, struct seccomp_notif *req)
- */
- int sys_notify_respond(int fd, struct seccomp_notif_resp *resp)
- {
-- if (_support_seccomp_user_notif <= 0)
-+ if (state.sup_user_notif <= 0)
- return -EOPNOTSUPP;
-
- if (ioctl(fd, SECCOMP_IOCTL_NOTIF_SEND, resp) < 0)
-@@ -467,7 +523,7 @@ int sys_notify_respond(int fd, struct seccomp_notif_resp *resp)
- */
- int sys_notify_id_valid(int fd, uint64_t id)
- {
-- if (_support_seccomp_user_notif <= 0)
-+ if (state.sup_user_notif <= 0)
- return -EOPNOTSUPP;
-
- if (ioctl(fd, SECCOMP_IOCTL_NOTIF_ID_VALID, &id) < 0)
-diff --git a/src/system.h b/src/system.h
-index 133f9b1..096f3ca 100644
---- a/src/system.h
-+++ b/src/system.h
-@@ -182,6 +182,8 @@ struct seccomp_notif_resp {
- #define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOR(2, __u64)
- #endif /* SECCOMP_RET_USER_NOTIF */
-
-+void sys_reset_state(void);
-+
- int sys_chk_seccomp_syscall(void);
- void sys_set_seccomp_syscall(bool enable);
-
-@@ -193,6 +195,7 @@ void sys_set_seccomp_flag(int flag, bool enable);
-
- int sys_filter_load(struct db_filter_col *col, bool rawrc);
-
-+int sys_notify_fd(void);
- int sys_notify_alloc(struct seccomp_notif **req,
- struct seccomp_notif_resp **resp);
- int sys_notify_receive(int fd, struct seccomp_notif *req);
-diff --git a/tests/11-basic-basic_errors.c b/tests/11-basic-basic_errors.c
-index d3b2256..da059df 100644
---- a/tests/11-basic-basic_errors.c
-+++ b/tests/11-basic-basic_errors.c
-@@ -41,12 +41,9 @@ int main(int argc, char *argv[])
- seccomp_release(ctx);
- ctx = NULL;
-
-- /* seccomp_reset error */
-- rc = seccomp_reset(ctx, SCMP_ACT_KILL + 1);
-- if (rc != -EINVAL)
-- return -1;
-- rc = seccomp_reset(ctx, SCMP_ACT_KILL);
-- if (rc != -EINVAL)
-+ /* ensure that seccomp_reset(NULL, ...) is accepted */
-+ rc = seccomp_reset(NULL, SCMP_ACT_ALLOW);
-+ if (rc != 0)
- return -1;
-
- /* seccomp_load error */
-diff --git a/tests/51-live-user_notification.c b/tests/51-live-user_notification.c
-index de31d2f..a00627b 100644
---- a/tests/51-live-user_notification.c
-+++ b/tests/51-live-user_notification.c
-@@ -98,6 +98,27 @@ int main(int argc, char *argv[])
- goto out;
- }
-
-+ rc = seccomp_reset(ctx, SCMP_ACT_ALLOW);
-+ if (rc < 0)
-+ goto out;
-+
-+ rc = seccomp_rule_add(ctx, SCMP_ACT_NOTIFY, SCMP_SYS(getppid), 0, NULL);
-+ if (rc)
-+ goto out;
-+
-+ rc = seccomp_load(ctx);
-+ if (rc < 0)
-+ goto out;
-+
-+ rc = seccomp_notify_fd(ctx);
-+ if (rc < 0)
-+ goto out;
-+ if (rc != fd) {
-+ rc = -EFAULT;
-+ goto out;
-+ } else
-+ rc = 0;
-+
- out:
- if (fd >= 0)
- close(fd);
-diff --git a/tests/51-live-user_notification.py b/tests/51-live-user_notification.py
-index 0d81f5e..3449c44 100755
---- a/tests/51-live-user_notification.py
-+++ b/tests/51-live-user_notification.py
-@@ -52,6 +52,10 @@ def test():
- raise RuntimeError("Child process error")
- if os.WEXITSTATUS(rc) != 0:
- raise RuntimeError("Child process error")
-+ f.reset(ALLOW)
-+ f.add_rule(NOTIFY, "getppid")
-+ f.load()
-+ # no easy way to check the notification fd here
- quit(160)
-
- test()
---
-2.26.2
-
diff --git a/0102-system-change-our-notification-fd-handling.patch
b/0102-system-change-our-notification-fd-handling.patch
deleted file mode 100644
index 3ffe19e..0000000
--- a/0102-system-change-our-notification-fd-handling.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 5201e324d2025b1febbade9bb90d6e405b92a14c Mon Sep 17 00:00:00 2001
-From: Paul Moore <paul(a)paul-moore.com>
-Date: Tue, 4 Aug 2020 10:52:08 -0400
-Subject: [PATCH 102/102] system: change our notification fd handling
-
-This commit changes how we handle the notification fd by only
-requesting it via _NEW_LISTENER if the filter has a _NOTIFY action
-in it. We also augment the seccomp_reset(NULL, ...) behavior so
-that it closes the notification fd before resetting the global
-state; applications that need to keep their notification fd open
-across a call to seccomp_reset(NULL, ...) can simply dup() it.
-Although one would have to wonder why the application would be
-calling seccomp_reset(NULL, ...) in that case.
-
-Signed-off-by: Paul Moore <paul(a)paul-moore.com>
----
- doc/man/man3/seccomp_init.3 | 6 ++++--
- src/system.c | 18 +++++++++++++++---
- 2 files changed, 19 insertions(+), 5 deletions(-)
-
-diff --git a/doc/man/man3/seccomp_init.3 b/doc/man/man3/seccomp_init.3
-index 87520cd..7881c35 100644
---- a/doc/man/man3/seccomp_init.3
-+++ b/doc/man/man3/seccomp_init.3
-@@ -38,8 +38,10 @@ and can only be called after a call to
- .BR seccomp_init ()
- has succeeded. If
- .BR seccomp_reset ()
--is called with a NULL filter, it resets the library's global task state;
--normally this is not needed, but it may be required to continue using the
-+is called with a NULL filter, it resets the library's global task state,
-+including any notification file descriptors retrieved by
-+.BR seccomp_notify_fd(3) .
-+Normally this is not needed, but it may be required to continue using the
- library after a
- .BR fork ()
- or
-diff --git a/src/system.c b/src/system.c
-index 3b43b2a..c646c65 100644
---- a/src/system.c
-+++ b/src/system.c
-@@ -84,7 +84,11 @@ static struct task_state state = {
- void sys_reset_state(void)
- {
- state.nr_seccomp = -1;
-+
-+ if (state.notify_fd > 0)
-+ close(state.notify_fd);
- state.notify_fd = -1;
-+
- state.sup_syscall = -1;
- state.sup_flag_tsync = -1;
- state.sup_flag_log = -1;
-@@ -353,6 +357,7 @@ int sys_filter_load(struct db_filter_col *col, bool rawrc)
- {
- int rc;
- bool tsync_notify;
-+ bool listener_req;
- struct bpf_program *prgm = NULL;
-
- rc = gen_bpf_generate(col, &prgm);
-@@ -367,6 +372,8 @@ int sys_filter_load(struct db_filter_col *col, bool rawrc)
- }
-
- tsync_notify = state.sup_flag_tsync_esrch > 0 && state.notify_fd == -1;
-+ listener_req = state.sup_user_notif > 0 && \
-+ col->notify_used && state.notify_fd == -1;
-
- /* load the filter into the kernel */
- if (sys_chk_seccomp_syscall() == 1) {
-@@ -375,11 +382,16 @@ int sys_filter_load(struct db_filter_col *col, bool rawrc)
- if (col->attr.tsync_enable)
- flgs |= SECCOMP_FILTER_FLAG_TSYNC | \
- SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
-- if (state.sup_user_notif > 0)
-+ if (listener_req)
- flgs |= SECCOMP_FILTER_FLAG_NEW_LISTENER;
-- } else if (col->attr.tsync_enable)
-+ } else if (col->attr.tsync_enable) {
-+ if (listener_req) {
-+ /* NOTE: we _should_ catch this in db.c */
-+ rc = -EFAULT;
-+ goto filter_load_out;
-+ }
- flgs |= SECCOMP_FILTER_FLAG_TSYNC;
-- else if (state.sup_user_notif > 0 && state.notify_fd == -1)
-+ } else if (listener_req)
- flgs |= SECCOMP_FILTER_FLAG_NEW_LISTENER;
- if (col->attr.log_enable)
- flgs |= SECCOMP_FILTER_FLAG_LOG;
---
-2.26.2
-
commit 529c95767dc1b6ca1e73c4bf8c5c8b2734d2e0c8
Author: Debarshi Ray <debarshir(a)gnome.org>
Date: Wed Nov 3 11:36:05 2021 +0100
New upstream version (#1900097)
diff --git a/.gitignore b/.gitignore
index 550a712..54770ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@
/libseccomp-2.4.1.tar.gz
/libseccomp-2.4.2.tar.gz
/libseccomp-2.5.0.tar.gz
+/libseccomp-2.5.1.tar.gz
diff --git a/libseccomp.spec b/libseccomp.spec
index c070fde..04e7081 100644
--- a/libseccomp.spec
+++ b/libseccomp.spec
@@ -1,19 +1,11 @@
Name: libseccomp
-Version: 2.5.0
-Release: 5%{?dist}
+Version: 2.5.1
+Release: 1%{?dist}
Summary: Enhanced seccomp library
License: LGPLv2
URL:
https://github.com/seccomp/libseccomp
Source0: %{url}/releases/download/v%{version}/%{name}-%{version}.tar.gz
-# Backports from upstream
-
-# Patches pending merge
-## From:
https://github.com/seccomp/libseccomp/pull/280
-## Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=1865802
-Patch0101: 0101-all-only-request-the-userspace-notification-fd-once.patch
-Patch0102: 0102-system-change-our-notification-fd-handling.patch
-
BuildRequires: gcc
BuildRequires: gperf
BuildRequires: make
@@ -70,11 +62,6 @@ mkdir -p %{buildroot}/%{_mandir}
rm -f %{buildroot}/%{_libdir}/libseccomp.la
%check
-# Tests 36 and 37 fail on the build systems for the arches below and I'm not
-# able to reproduce the failure so just skip the tests for now
-%ifarch i686 ppc64le s390x
-rm -f tests/36-sim-ipc_syscalls.tests tests/37-sim-ipc_syscalls_be.tests
-%endif
%make_build check
@@ -96,6 +83,9 @@ rm -f tests/36-sim-ipc_syscalls.tests
tests/37-sim-ipc_syscalls_be.tests
%{_libdir}/libseccomp.a
%changelog
+* Wed Nov 03 2021 Debarshi Ray <rishi(a)fedoraproject.org> - 2.5.1-1
+- New upstream version (#1900097)
+
* Thu Jul 22 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.5.0-5
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
diff --git a/sources b/sources
index 99aebbc..27d4059 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (libseccomp-2.5.0.tar.gz) =
00ef5aeb4db8dafb546ae680b2d6d9b6aeed008df805d0f28f9dd15c074ff6ea7a5e5131ab503825b8011c59aa23046baedd5849ca040aa73352f43ab2d602ae
+SHA512 (libseccomp-2.5.1.tar.gz) =
2be80a6323f9282dbeae8791724e5778b32e2382b2a3d1b0f77366371ec4072ea28128204f675cce101c091c0420d12c497e1a9ccbb7dc5bcbf61bfd777160af
commit 8f99b157cad88bbefa84f6e31f9b111ed1c93972
Author: Debarshi Ray <debarshir(a)gnome.org>
Date: Wed Nov 3 11:36:39 2021 +0100
Silence macro-in-%changelog
diff --git a/libseccomp.spec b/libseccomp.spec
index 564d600..c070fde 100644
--- a/libseccomp.spec
+++ b/libseccomp.spec
@@ -130,7 +130,7 @@ rm -f tests/36-sim-ipc_syscalls.tests
tests/37-sim-ipc_syscalls_be.tests
* Thu Mar 14 2019 Paul Moore <paul(a)paul-moore.com> - 2.4.0-0
- New upstream version
-- Added a hack to workaround test failures (see %check above)
+- Added a hack to workaround test failures (see %%check above)
* Fri Feb 01 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.3.3-5
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
commit bc0c71882c0d2b045f1e8ab65290a46a3e378e80
Author: Fedora Release Engineering <releng(a)fedoraproject.org>
Date: Thu Jul 22 12:21:02 2021 +0000
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org>
diff --git a/libseccomp.spec b/libseccomp.spec
index 8c4246c..564d600 100644
--- a/libseccomp.spec
+++ b/libseccomp.spec
@@ -1,6 +1,6 @@
Name: libseccomp
Version: 2.5.0
-Release: 4%{?dist}
+Release: 5%{?dist}
Summary: Enhanced seccomp library
License: LGPLv2
URL:
https://github.com/seccomp/libseccomp
@@ -96,6 +96,9 @@ rm -f tests/36-sim-ipc_syscalls.tests
tests/37-sim-ipc_syscalls_be.tests
%{_libdir}/libseccomp.a
%changelog
+* Thu Jul 22 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.5.0-5
+- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.5.0-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
commit 282423f64b350872534fae202ac561eeacadcde1
Author: Fedora Release Engineering <releng(a)fedoraproject.org>
Date: Tue Jan 26 17:58:46 2021 +0000
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org>
diff --git a/libseccomp.spec b/libseccomp.spec
index 0212a69..8c4246c 100644
--- a/libseccomp.spec
+++ b/libseccomp.spec
@@ -1,6 +1,6 @@
Name: libseccomp
Version: 2.5.0
-Release: 3%{?dist}
+Release: 4%{?dist}
Summary: Enhanced seccomp library
License: LGPLv2
URL:
https://github.com/seccomp/libseccomp
@@ -96,6 +96,9 @@ rm -f tests/36-sim-ipc_syscalls.tests
tests/37-sim-ipc_syscalls_be.tests
%{_libdir}/libseccomp.a
%changelog
+* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.5.0-4
+- Rebuilt for
https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
* Wed Aug 05 2020 Neal Gompa <ngompa13(a)gmail.com> - 2.5.0-3
- Apply fixes to change internal handling of the notification fd (#1865802)