samples: user-trap: fix strict-aliasing warning

I started getting warnings for this one file, though I can't see what changed
since it was originally introduced in commit fec7b6690541 ("samples: add

samples: user-trap: fix strict-aliasing warning

I started getting warnings for this one file, though I can't see what changed
since it was originally introduced in commit fec7b6690541 ("samples: add an
example of seccomp user trap").

samples/seccomp/user-trap.c: In function 'send_fd':
samples/seccomp/user-trap.c:50:11: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing]
50 | *((int *)CMSG_DATA(cmsg)) = fd;
| ~^~~~~~~~~~~~~~~~~~~~~~~
samples/seccomp/user-trap.c: In function 'recv_fd':
samples/seccomp/user-trap.c:83:18: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing]
83 | return *((int *)CMSG_DATA(cmsg));
| ~^~~~~~~~~~~~~~~~~~~~~~~

Using a temporary pointer variable avoids the warning.

Signed-off-by: Arnd Bergmann <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Acked-by: Tycho Andersen <[email protected]>
Signed-off-by: Kees Cook <[email protected]>

show more ...

samples/seccomp: Zero out members based on seccomp_notif_sizes

The sizes by which seccomp_notif and seccomp_notif_resp are allocated are
based on the SECCOMP_GET_NOTIF_SIZES ioctl. This allows for g

samples/seccomp: Zero out members based on seccomp_notif_sizes

The sizes by which seccomp_notif and seccomp_notif_resp are allocated are
based on the SECCOMP_GET_NOTIF_SIZES ioctl. This allows for graceful
extension of these datastructures. If userspace zeroes out the
datastructure based on its version, and it is lagging behind the kernel's
version, it will end up sending trailing garbage. On the other hand,
if it is ahead of the kernel version, it will write extra zero space,
and potentially cause corruption.

Signed-off-by: Sargun Dhillon <[email protected]>
Suggested-by: Tycho Andersen <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Fixes: fec7b6690541 ("samples: add an example of seccomp user trap")
Cc: [email protected]
Signed-off-by: Kees Cook <[email protected]>

show more ...

samples: add an example of seccomp user trap

The idea here is just to give a demonstration of how one could safely use
the SECCOMP_RET_USER_NOTIF feature to do mount policies. This particular
policy

samples: add an example of seccomp user trap

The idea here is just to give a demonstration of how one could safely use
the SECCOMP_RET_USER_NOTIF feature to do mount policies. This particular
policy is (as noted in the comment) not very interesting, but it serves to
illustrate how one might apply a policy dodging the various TOCTOU issues.

Signed-off-by: Tycho Andersen <[email protected]>
CC: Kees Cook <[email protected]>
CC: Andy Lutomirski <[email protected]>
CC: Oleg Nesterov <[email protected]>
CC: Eric W. Biederman <[email protected]>
CC: "Serge E. Hallyn" <[email protected]>
CC: Christian Brauner <[email protected]>
CC: Tyler Hicks <[email protected]>
CC: Akihiro Suda <[email protected]>
Signed-off-by: Kees Cook <[email protected]>

show more ...