Skip to content

Refactor seccomp syscall-list machinery + guard notify/deny overlap #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
congwang-mk merged 4 commits into from
Jun 1, 2026
+519 −330
Merged

Refactor seccomp syscall-list machinery + guard notify/deny overlap #82

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f6edaa1
core: move syscall name mapping out of context
congwang-mk Jun 1, 2026
f2e7cb7
seccomp: guard against notify/deny list overlap
congwang-mk Jun 1, 2026
80e7315
core: refactor notification syscall list builder
congwang-mk Jun 1, 2026
f53599b
http: Move HTTP net allow normalization
congwang-mk Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions crates/sandlock-core/src/arch.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,12 @@
//! Architecture-specific syscall and seccomp helpers.

/// `faccessat2(2)` syscall number on Sandlock's supported Linux architectures.
///
/// The `libc` crate does not expose this constant on all supported build
/// targets yet, but the seccomp filters and path virtualization handlers need
/// to intercept it because glibc 2.33+ may prefer it over `faccessat`.
pub const SYS_FACCESSAT2: i64 = 439;

#[cfg(target_arch = "x86_64")]
mod imp {
pub const AUDIT_ARCH: u32 = 0xC000_003E;
Expand Down
5 changes: 1 addition & 4 deletions crates/sandlock-core/src/chroot/dispatch.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -334,9 +334,6 @@ fn exec_on_host(f: impl FnOnce(*const libc::c_char) -> libc::c_int, host: &Path)
}
}

/// SYS_faccessat2 syscall number (439 on both x86_64 and aarch64).
pub(crate) const SYS_FACCESSAT2: i64 = 439;

// ============================================================
// openat handler
// ============================================================
Expand Down Expand Up @@ -1072,7 +1069,7 @@ pub(crate) async fn handle_chroot_stat(
Err(a) => return a,
};

if nr == libc::SYS_faccessat || nr == SYS_FACCESSAT2 {
if nr == libc::SYS_faccessat || nr == crate::arch::SYS_FACCESSAT2 {
return if real_path.exists() || real_path.is_symlink() {
NotifAction::ReturnValue(0)
} else {
Expand Down
Loading
Loading