seccomp: apply all argument conditions

remove the arbitrary limit of 6 conditions.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Author: giuseppe

src/libcrun/seccomp.c

@@ -813,54 +813,65 @@ libcrun_generate_seccomp (struct libcrun_seccomp_gen_ctx_s *gen_ctx, libcrun_err
           else
             {
               size_t k;
-              struct scmp_arg_cmp arg_cmp[6];
               bool multiple_args = false;
               uint32_t count[6] = {};
 
-              for (k = 0; k < seccomp->syscalls[i]->args_len && k < 6; k++)
+              for (k = 0; k < seccomp->syscalls[i]->args_len; k++)
                 {
                   uint32_t index;
 
                   index = seccomp->syscalls[i]->args[k]->index;
                   if (index >= 6)
-                    return crun_make_error (err, 0, "invalid seccomp index `%zu`", i);
+                    return crun_make_error (err, 0, "invalid seccomp index `%u`", index);
 
                   count[index]++;
                   if (count[index] > 1)
-                    {
-                      multiple_args = true;
-                      break;
-                    }
+                    multiple_args = true;
                 }
 
-              for (k = 0; k < seccomp->syscalls[i]->args_len && k < 6; k++)
+              /* If multiple rules refer to the same argument, treat the rules are in OR.  */
+              if (multiple_args)
                 {
-                  char *op = seccomp->syscalls[i]->args[k]->op;
+                  size_t r;
 
-                  arg_cmp[k].arg = seccomp->syscalls[i]->args[k]->index;
-                  ret = get_seccomp_operator (op, &(arg_cmp[k].op), err);
-                  if (UNLIKELY (ret < 0))
-                    return ret;
-                  arg_cmp[k].datum_a = seccomp->syscalls[i]->args[k]->value;
-                  arg_cmp[k].datum_b = seccomp->syscalls[i]->args[k]->value_two;
-                }
+                  for (r = 0; r < seccomp->syscalls[i]->args_len; r++)
+                    {
+                      struct scmp_arg_cmp arg_cmp;
+                      char *op = seccomp->syscalls[i]->args[r]->op;
 
-              if (! multiple_args)
-                {
-                  ret = seccomp_rule_add_array (ctx, action, syscall, k, arg_cmp);
-                  if (UNLIKELY (ret < 0))
-                    return crun_make_error (err, -ret, "seccomp_rule_add_array");
+                      arg_cmp.arg = seccomp->syscalls[i]->args[r]->index;
+                      ret = get_seccomp_operator (op, &arg_cmp.op, err);
+                      if (UNLIKELY (ret < 0))
+                        return ret;
+                      arg_cmp.datum_a = seccomp->syscalls[i]->args[r]->value;
+                      arg_cmp.datum_b = seccomp->syscalls[i]->args[r]->value_two;
+
+                      ret = seccomp_rule_add_array (ctx, action, syscall, 1, &arg_cmp);
+                      if (UNLIKELY (ret < 0))
+                        return crun_make_error (err, -ret, "seccomp_rule_add_array");
+                    }
                 }
               else
                 {
-                  size_t r;
+                  /* No index is repeated, so there are at most 6 distinct arguments.  */
+                  const size_t args_len = seccomp->syscalls[i]->args_len;
+                  struct scmp_arg_cmp arg_cmp[6];
 
-                  for (r = 0; r < k; r++)
+                  for (k = 0; k < args_len; k++)
                     {
-                      ret = seccomp_rule_add_array (ctx, action, syscall, 1, &arg_cmp[r]);
+                      char *op = seccomp->syscalls[i]->args[k]->op;
+
+                      arg_cmp[k].arg = seccomp->syscalls[i]->args[k]->index;
+                      ret = get_seccomp_operator (op, &(arg_cmp[k].op), err);
                       if (UNLIKELY (ret < 0))
-                        return crun_make_error (err, -ret, "seccomp_rule_add_array");
+                        return ret;
+                      arg_cmp[k].datum_a = seccomp->syscalls[i]->args[k]->value;
+                      arg_cmp[k].datum_b = seccomp->syscalls[i]->args[k]->value_two;
                     }
+
+                  ret = seccomp_rule_add_array (ctx, action, syscall, args_len, arg_cmp);
+                  if (UNLIKELY (ret < 0))
+                    return crun_make_error (err, -ret, "seccomp_rule_add_array");
                 }
             }
         }

tests/init.c

@@ -501,6 +501,20 @@ main (int argc, char **argv)
       exit (0);
     }
 
+  if (strcmp (argv[1], "socket") == 0)
+    {
+      int fd;
+
+      if (argc < 3)
+        error (EXIT_FAILURE, 0, "'socket' requires an argument");
+
+      fd = socket (atoi (argv[2]), SOCK_DGRAM, 0);
+      if (fd < 0)
+        error (EXIT_FAILURE, errno, "socket");
+      close (fd);
+      return 0;
+    }
+
   if (strcmp (argv[1], "printenv") == 0)
     {
       const char *value;

tests/test_seccomp.py

@@ -275,6 +275,42 @@ def test_seccomp_syscall_args():
         return -1
 
 
+def test_seccomp_more_than_six_syscall_args():
+    conf = base_config()
+    add_all_namespaces(conf)
+
+    conf['linux']['seccomp'] = {
+        'defaultAction': 'SCMP_ACT_ALLOW',
+        'syscalls': [
+            {
+                'names': ['socket'],
+                'action': 'SCMP_ACT_ERRNO',
+                'errnoRet': 1,
+                'args': [
+                    {'index': 0, 'value': value, 'op': 'SCMP_CMP_EQ'}
+                    for value in [0, 1, 3, 4, 5, 6, 7, 2]
+                ]
+            }
+        ]
+    }
+
+    conf['process']['args'] = ['/init', 'socket', '2']
+
+    try:
+        run_and_get_output(conf)
+    except subprocess.CalledProcessError as e:
+        if e.output is not None and b'Operation not permitted' in e.output:
+            return 0
+        logger.info("socket was not blocked by seccomp")
+        return -1
+    except Exception as e:
+        logger.info("Exception: %s", e)
+        return -1
+
+    logger.info("socket was not blocked by seccomp")
+    return -1
+
+
 def test_seccomp_multiple_syscalls():
     """Test seccomp with multiple syscalls in one rule."""
     conf = base_config()
@@ -624,6 +660,7 @@ def test_seccomp_invalid_flag():
     "seccomp-log-action": test_seccomp_log_action,
     "seccomp-kill-action": test_seccomp_kill_action,
     "seccomp-syscall-args": test_seccomp_syscall_args,
+    "seccomp-more-than-six-syscall-args": test_seccomp_more_than_six_syscall_args,
     "seccomp-multiple-syscalls": test_seccomp_multiple_syscalls,
     "seccomp-errno-default": test_seccomp_errno_default,
     "seccomp-comparison-ops": test_seccomp_comparison_ops,