summaryrefslogtreecommitdiff
path: root/nix/libutil
diff options
context:
space:
mode:
Diffstat (limited to 'nix/libutil')
-rw-r--r--nix/libutil/seccomp.cc162
-rw-r--r--nix/libutil/seccomp.hh222
-rw-r--r--nix/libutil/spawn.cc36
-rw-r--r--nix/libutil/spawn.hh10
4 files changed, 430 insertions, 0 deletions
diff --git a/nix/libutil/seccomp.cc b/nix/libutil/seccomp.cc
new file mode 100644
index 00000000000..585442d70b5
--- /dev/null
+++ b/nix/libutil/seccomp.cc
@@ -0,0 +1,162 @@
1#if __linux__
2#include <util.hh>
3#include <seccomp.hh>
4#include <algorithm>
5
6namespace nix {
7
8struct FilterInstruction {
9 struct sock_filter instruction;
10 bool fallthroughJt = false;
11 bool fallthroughJf = false;
12 bool fallthroughK = false;
13};
14
15/* Note: instructions in "out" should have already verified that sysno is
16 * >= ranges[lowIndex].low. The value to compare against should already be
17 * in the accumulator. */
18static void
19rangeActionsToFilter(std::vector<Uint32RangeAction> & ranges,
20 size_t lowIndex, /* Inclusive */
21 size_t end, /* Exclusive */
22 std::vector<FilterInstruction> & out)
23{
24 if(lowIndex >= end) return;
25
26 if(end == lowIndex + 1) {
27 FilterInstruction branch;
28 Uint32RangeAction range = ranges.at(lowIndex);
29 branch.instruction = BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K,
30 range.high,
31 /* To be fixed up */
32 0,
33 0);
34 branch.fallthroughJt = true;
35 out.push_back(branch);
36 for(auto & i : range.instructions) {
37 FilterInstruction f;
38 f.instruction = i;
39 out.push_back(f);
40 }
41 FilterInstruction fallthroughBranch;
42 fallthroughBranch.instruction = BPF_JUMP(BPF_JMP | BPF_JA | BPF_K,
43 /* To be fixed up */
44 0,
45 0,
46 0);
47 fallthroughBranch.fallthroughK = true;
48 out.push_back(fallthroughBranch);
49 return;
50 }
51
52 size_t middle = lowIndex + ((end - lowIndex) / 2);
53 Uint32RangeAction range = ranges.at(middle);
54 FilterInstruction branch;
55 size_t branchIndex = out.size();
56 branch.instruction = BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K,
57 range.low,
58 0,
59 /* To be fixed up a little farther down */
60 0);
61 out.push_back(branch);
62 rangeActionsToFilter(ranges, middle, end, out);
63 size_t elseIndex = out.size();
64 out[branchIndex].instruction.jf = (elseIndex - branchIndex - 1);
65 rangeActionsToFilter(ranges, lowIndex, middle, out);
66}
67
68
69static bool compareRanges(Uint32RangeAction a, Uint32RangeAction b)
70{
71 return (a.low < b.low);
72}
73
74
75/* Produce a loop-unrolled binary search of RANGES for the u32 currently in
76 * the accumulator. If the binary search finds a range that contains it, it
77 * will execute the corresponding instructions. If these instructions fall
78 * through, or if no containing range is found, control resumes after the last
79 * instruction in the returned sequence. */
80std::vector<struct sock_filter>
81rangeActionsToFilter(std::vector<Uint32RangeAction> & ranges)
82{
83 if(ranges.size() == 0) return {};
84 std::sort(ranges.begin(), ranges.end(), compareRanges);
85 if(ranges.size() > 1) {
86 for(auto & i : ranges)
87 if(i.low > i.high)
88 throw Error("Invalid range in rangeActionsToFilter");
89 for(size_t j = 1; j < ranges.size(); j++)
90 if(ranges[j].low <= ranges[j - 1].high)
91 throw Error("Overlapping ranges in rangeActionsToFilter");
92 }
93 std::vector<FilterInstruction> out;
94 Uint32RangeAction first = ranges.at(0);
95 FilterInstruction branch;
96 /* Verify accumulator value is >= first.low, to satisfy initial invariant */
97 branch.instruction = BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K,
98 first.low,
99 0,
100 /* to be fixed up */
101 0);
102 branch.fallthroughJf = true;
103 out.push_back(branch);
104 rangeActionsToFilter(ranges, 0, ranges.size(), out);
105 size_t fallthrough = out.size();
106 std::vector<struct sock_filter> out2;
107 for(size_t j = 0; j < out.size(); j++) {
108 if(out[j].fallthroughJt) out[j].instruction.jt = (fallthrough - j - 1);
109 if(out[j].fallthroughJf) out[j].instruction.jf = (fallthrough - j - 1);
110 if(out[j].fallthroughK) out[j].instruction.k = (fallthrough - j - 1);
111 out2.push_back(out[j].instruction);
112 }
113 return out2;
114}
115
116
117/* If the uint64 at offset OFFSET has value VALUE, run INSTRUCTIONS.
118 * Otherwise, or if INSTRUCTIONS falls through, continue past the last
119 * instruction of OUT at the time seccompMatchu64 returns. Clobbers
120 * accumulator! */
121std::vector<struct sock_filter> seccompMatchu64(std::vector<struct sock_filter> & out,
122 uint64_t value,
123 std::vector<struct sock_filter> instructions,
124 uint32_t offset)
125{
126 /* Note: this only works where the order of bytes in uint64 is big or
127 * little endian, and the same order holds for uint32. */
128 /* Load lower-addressed 32 bits */
129 out.push_back(BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offset));
130 size_t jmp1Index = out.size();
131
132 out.push_back(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,
133#ifdef WORDS_BIGENDIAN
134 (uint32_t)((value >> 32) & 0xffffffff),
135#else
136 (uint32_t)(value & 0xffffffff),
137#endif
138 0,
139 /* To be fixed up */
140 0));
141 /* Load higher-addressed 32 bits */
142 out.push_back(BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offset + (uint32_t)sizeof(uint32_t)));
143 size_t jmp2Index = out.size();
144 out.push_back(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,
145#ifdef WORDS_BIGENDIAN
146 (uint32_t)(value & 0xffffffff),
147#else
148 (uint32_t)((value >> 32) & 0xffffffff),
149#endif
150 0,
151 /* To be fixed up */
152 0));
153
154 out.insert(out.end(), instructions.begin(), instructions.end());
155 out[jmp1Index].jf = (out.size() - jmp1Index - 1);
156 out[jmp2Index].jf = (out.size() - jmp2Index - 1);
157 return out;
158}
159
160}
161
162#endif
diff --git a/nix/libutil/seccomp.hh b/nix/libutil/seccomp.hh
new file mode 100644
index 00000000000..634dfad5f8e
--- /dev/null
+++ b/nix/libutil/seccomp.hh
@@ -0,0 +1,222 @@
1#pragma once
2
3#include "util.hh"
4#include <linux/audit.h> /* For AUDIT_ARCH_* */
5#include <linux/seccomp.h>
6#include <linux/filter.h>
7
8
9/* This file provides two preprocessor macros (among other things):
10 1. AUDIT_ARCH_NATIVE, which evaluates to whichever of the AUDIT_ARCH_*
11 values best represents the target system. Linux's internal headers have
12 a SECCOMP_ARCH_NATIVE since 2020, but it's not user-visible. Detection
13 of this is based on src/arch.c in libseccomp.
14 2. NATIVE_SYSCALL_RANGES, an array initializer for an array of two-element
15 objects, the first of which is an integral number representing the
16 start (inclusive) of a range of valid syscall numbers, and the second
17 of which is an integral number representing the end (inclusive) of that
18 range of valid syscall numbers. The ranges provided are all
19 non-overlapping and strictly ascending (that is, the start of a range is
20 strictly higher than any of the numbers in any of the ranges that
21 precede it). All numbers involved fit into a long.
22
23 These ranges were generated from the various syscall.tbl,
24 syscall_32.tbl, and syscall_64.tbl files lying around in the linux
25 kernel source. Some were derived from
26 include/uapi/asm-generic/unistd.h. The kernel source used was commit
27 b3ee1e460951 of https://github.com/torvalds/linux.git, read on
28 2025-04-23. Not all of the gaps in the files have any comments pointing
29 them out, so I recommend using build-aux/extract-syscall-ranges.sh for
30 the *.tbl files.
31
32 The intent behind saving these ranges is to be able to use a
33 default-allow seccomp policy that nevertheless disallows future
34 syscalls. This ensures that our security analysis can work with a
35 static, well-defined set of system calls that won't grow in the future
36 unless someone explicitly revisits the system call tables to consider
37 the implications of the new additions. */
38
39/* Both ends are inclusive. Some of the .tbl files use strange entries for
40 * the "abi" field, check arch/$ARCH/kernel/Makefile.syscalls to see what it
41 * specifies for syscall_abis_32 and syscall_abis_64 in addition to 32 or 64
42 * and "common" (added in Makefile.asm-headers). Also check what, if
43 * anything, the makefile uses as the --offset flag to syscallhdr.sh. And
44 * look at arch/$ARCH/include/uapi/asm/unistd.h to see what value the offset
45 * takes in what configurations. */
46
47#ifndef AUDIT_ARCH_NATIVE
48
49#if __i386__
50#define AUDIT_ARCH_NATIVE AUDIT_ARCH_I386
51#define NATIVE_SYSCALL_RANGES { {0, 221}, {224, 250}, {252, 284}, {286, 386}, \
52 {393, 414}, {416, 466} }
53#elif __x86_64__
54#define AUDIT_ARCH_NATIVE AUDIT_ARCH_X86_64
55#ifdef __ILP32__
56#include <asm/unistd.h>
57#define X32RANGE(low, high) { (low | __X32_SYSCALL_BIT), (high | __X32_SYSCALL_BIT) }
58#define NATIVE_SYSCALL_RANGES \
59 { X32RANGE(0, 12), X32RANGE(14, 14), X32RANGE(17, 18), X32RANGE(21, 44), X32RANGE(48, 53), \
60 X32RANGE(56, 58), X32RANGE(60, 100), X32RANGE(102, 126), X32RANGE(130, 130), \
61 X32RANGE(132, 133), X32RANGE(135, 155), X32RANGE(157, 173), X32RANGE(175, 176), \
62 X32RANGE(179, 179), X32RANGE(181, 204), X32RANGE(207, 208), X32RANGE(210, 210), \
63 X32RANGE(212, 213), X32RANGE(216, 221), X32RANGE(223, 235), X32RANGE(237, 243), \
64 X32RANGE(245, 245), X32RANGE(248, 272), X32RANGE(275, 277), X32RANGE(280, 294), \
65 X32RANGE(298, 298), X32RANGE(300, 306), X32RANGE(308, 309), X32RANGE(312, 321), \
66 X32RANGE(323, 326), X32RANGE(329, 335), X32RANGE(424, 466), X32RANGE(512, 547) }
67#else
68#define NATIVE_SYSCALL_RANGES { {0, 335}, {424, 466} }
69#endif
70#elif __arm__
71#define AUDIT_ARCH_NATIVE AUDIT_ARCH_ARM
72/* Note: there are at present 6 extra ARM syscall numbers not listed in
73 arch/arm/tools/syscall.tbl, namely __ARM_NR_breakpoint through
74 __ARM_NR_get_tls. */
75#ifdef __ARM_EABI__
76#include <asm/unistd.h>
77#define NATIVE_SYSCALL_RANGES \
78 { {0, 6}, {8, 12}, {14, 16}, {19, 21}, {23, 24}, {26, 26}, {29, 29}, \
79 {33, 34}, {36, 43}, {45, 47}, {49, 52}, {54, 55}, {57, 57}, {60, 67}, \
80 {70, 75}, {77, 81}, {83, 83}, {85, 88}, {91, 97}, {99, 100}, {103, 108}, \
81 {111, 111}, {114, 116}, {118, 122}, {124, 126}, {128, 129}, {131, 136}, \
82 {138, 165}, {168, 187}, {190, 221}, {224, 253}, {256, 401}, {403, 414}, \
83 {416, 446}, {448, 466}, {(__ARM_NR_BASE + 1), (__ARM_NR_BASE + 6)} }
84#else
85#include <asm/unistd.h>
86#define OABIRANGE(low, high) { (low | __NR_OABI_SYSCALL_BASE), (high | __NR_OABI_SYSCALL_BASE) }
87#define NATIVE_SYSCALL_RANGES \
88 { OABIRANGE(0, 6), OABIRANGE(8, 16), OABIRANGE(19, 27), OABIRANGE(29, 30), \
89 OABIRANGE(33, 34), OABIRANGE(36, 43), OABIRANGE(45, 47), OABIRANGE(49, 52), \
90 OABIRANGE(54, 55), OABIRANGE(57, 57), OABIRANGE(60, 67), OABIRANGE(70, 83), \
91 OABIRANGE(85, 97), OABIRANGE(99, 100), OABIRANGE(102, 108), \
92 OABIRANGE(111, 111), OABIRANGE(113, 122), OABIRANGE(124, 126), \
93 OABIRANGE(128, 129), OABIRANGE(131, 136), OABIRANGE(138, 165), \
94 OABIRANGE(168, 187), OABIRANGE(190, 221), OABIRANGE(224, 253), \
95 OABIRANGE(256, 401), OABIRANGE(403, 414), OABIRANGE(416, 446), \
96 OABIRANGE(448, 466), {(__ARM_NR_BASE + 1), (__ARM_NR_BASE + 6)} }
97#endif
98#elif __aarch64__
99#define AUDIT_ARCH_NATIVE AUDIT_ARCH_AARCH64
100/* extract-syscall-ranges.sh $LINUXSOURCE/arch/arm64/tools/syscall_64.tbl \
101 '64|renameat|rlimit|memfd_secret'
102
103 the extra ABIs are taken from arch/arm64/kernel/Makefile.syscalls and
104 scripts/Makefile.asm-headers */
105#define NATIVE_SYSCALL_RANGES { {0, 243}, {260, 294}, {424, 466} }
106/* To my knowledge there is no x32 equivalent for aarch64 in mainline linux */
107#elif __mips__ && _MIPS_SIM == _MIPS_SIM_ABI32
108/* o32 abi in both endianness cases */
109#include <asm/unistd.h>
110#define SYSRANGE(low, high) {(low) + __NR_Linux, (high) + __NR_Linux}
111#define NATIVE_SYSCALL_RANGES \
112 { SYSRANGE(0, 278), SYSRANGE(280, 368), SYSRANGE(393, 414), \
113 SYSRANGE(416, 446), SYSRANGE(448, 466) }
114#if __MIPSEB__
115#define AUDIT_ARCH_NATIVE AUDIT_ARCH_MIPS;
116#elif __MIPSEL__
117#define AUDIT_ARCH_NATIVE AUDIT_ARCH_MIPSEL
118#endif
119#elif __mips__ && _MIPS_SIM == _MIPS_SIM_ABI64
120/* n64 abi in both endianness cases */
121#include <asm/unistd.h>
122#define SYSRANGE(low, high) {(low) + __NR_Linux, (high) + __NR_Linux}
123#define NATIVE_SYSCALL_RANGES \
124 { SYSRANGE(0, 237), SYSRANGE(239, 328), SYSRANGE(424, 446), SYSRANGE(448, 466) }
125#if __MIPSEB__
126#define AUDIT_ARCH_NATIVE AUDIT_ARCH_MIPS64
127#elif __MIPSEL__
128#define AUDIT_ARCH_NATIVE AUDIT_ARCH_MIPSEL64
129#endif /* _MIPS_SIM_ABI64 */
130#elif __mips__ && _MIPS_SIM == _MIPS_SIM_NABI32
131/* n32 abi in both endianness cases */
132#include <asm/unistd.h>
133#define SYSRANGE(low, high) {(low) + __NR_Linux, (high) + __NR_Linux}
134#define NATIVE_SYSCALL_RANGES \
135 { SYSRANGE(0, 241), SYSRANGE(243, 332), SYSRANGE(403, 414), \
136 SYSRANGE(416, 446), SYSRANGE(448, 466) }
137#if __MIPSEB__
138#define AUDIT_ARCH_NATIVE AUDIT_ARCH_MIPS64N32
139#elif __MIPSEL__
140#define AUDIT_ARCH_NATIVE AUDIT_ARCH_MIPSEL64N32
141#endif /* _MIPS_SIM_NABI32 */
142#elif __hppa64__ /* hppa64 must be checked before hppa */
143#define NATIVE_SYSCALL_RANGES \
144 { {0, 101}, {103, 126}, {128, 129}, {131, 136}, {138, 166}, \
145 {168, 168}, {170, 195}, {198, 202}, {206, 212}, {215, 219}, \
146 {222, 262}, {264, 302}, {304, 356}, {424, 446}, {448, 466} }
147#define AUDIT_ARCH_NATIVE AUDIT_ARCH_PARISC64
148#elif __hppa__
149#define NATIVE_SYSCALL_RANGES \
150 { {0, 101}, {103, 126}, {128, 129}, {131, 136}, {138, 166}, \
151 {168, 168}, {170, 195}, {198, 202}, {206, 212}, {215, 219}, \
152 {222, 262}, {264, 302}, {304, 356}, {403, 414}, {416, 446}, {448, 466} }
153#define AUDIT_ARCH_NATIVE AUDIT_ARCH_PARISC
154#elif __PPC64__
155#define NATIVE_SYSCALL_RANGES \
156 { {0, 191}, {198, 203}, {205, 223}, {225, 225}, {227, 253}, \
157 {255, 256}, {258, 365}, {378, 388}, {392, 402}, {424, 446}, {448, 466} }
158#ifdef __BIG_ENDIAN__
159#define AUDIT_ARCH_NATIVE AUDIT_ARCH_PPC64
160#else
161#define AUDIT_ARCH_NATIVE AUDIT_ARCH_PPC64LE
162#endif
163#elif __PPC__
164#define NATIVE_SYSCALL_RANGES \
165 { {0, 223}, {225, 256}, {258, 365}, {378, 388}, {393, 414}, \
166 {416, 446}, {448, 466} }
167#define AUDIT_ARCH_NATIVE AUDIT_ARCH_PPC
168#elif __s390x__ /* s390x must be checked before s390 */
169#define NATIVE_SYSCALL_RANGES \
170 { {1, 12}, {14, 15}, {19, 22}, {26, 27}, {29, 30}, {33, 34}, \
171 {36, 43}, {45, 45}, {48, 48}, {51, 52}, {54, 55}, {57, 57}, \
172 {60, 67}, {72, 75}, {77, 79}, {83, 83}, {85, 94}, {96, 97}, \
173 {99, 100}, {102, 108}, {110, 112}, {114, 122}, {124, 137}, \
174 {141, 163}, {167, 169}, {172, 181}, {183, 191}, {198, 220}, \
175 {222, 222}, {224, 241}, {243, 262}, {265, 386}, {392, 402}, {424, 466} }
176#define AUDIT_ARCH_NATIVE AUDIT_ARCH_S390X
177#elif __s390__
178#define NATIVE_SYSCALL_RANGES \
179 { {1, 16}, {19, 27}, {29, 30}, {33, 34}, {36, 43}, {45, 52}, \
180 {54, 55}, {57, 57}, {60, 67}, {70, 81}, {83, 83}, {85, 97}, \
181 {99, 108}, {110, 112}, {114, 122}, {124, 165}, {167, 241}, \
182 {243, 262}, {264, 386}, {393, 414}, {416, 466} }
183#define AUDIT_ARCH_NATIVE AUDIT_ARCH_S390
184#elif __riscv && __riscv_xlen == 64
185#define NATIVE_SYSCALL_RANGES { {0, 37}, {39, 243}, {258, 294}, {424, 466} }
186#define AUDIT_ARCH_NATIVE AUDIT_ARCH_RISCV64
187#elif __riscv && __riscv_xlen == 32
188#define NATIVE_SYSCALL_RANGES \
189 { {0, 3}, {5, 37}, {39, 71}, {74, 78}, {81, 85}, {89, 97}, {99, 100}, \
190 {102, 107}, {109, 109}, {111, 111}, {116, 126}, {128, 136}, {138, 162}, \
191 {165, 168}, {172, 181}, {184, 191}, {193, 242}, {258, 259}, {261, 265}, \
192 {267, 291}, {293, 294}, {403, 414}, {416, 466} }
193#define AUDIT_ARCH_NATIVE AUDIT_ARCH_RISCV32
194#else
195#error cannot determine which AUDIT_ARCH_* value to use for AUDIT_ARCH_NATIVE
196#endif
197
198#else
199#ifndef NATIVE_SYSCALL_RANGES
200/* Fall back to default-allow if the user specified (with
201 -DAUDIT_ARCH_NATIVE=...) an arch but not NATIVE_SYSCALL_RANGES */
202#define NATIVE_SYSCALL_RANGES {}
203#endif
204#endif /* #ifndef AUDIT_ARCH_NATIVE */
205
206namespace nix {
207
208struct Uint32RangeAction {
209 uint32_t low; /* inclusive */
210 uint32_t high; /* inclusive */
211 std::vector<struct sock_filter> instructions;
212};
213
214std::vector<struct sock_filter> rangeActionsToFilter(std::vector<Uint32RangeAction> & ranges);
215
216
217std::vector<struct sock_filter>
218seccompMatchu64(std::vector<struct sock_filter> & out,
219 uint64_t value,
220 std::vector<struct sock_filter> instructions,
221 uint32_t offset);
222}
diff --git a/nix/libutil/spawn.cc b/nix/libutil/spawn.cc
index 93bab9f59e4..414849b6f04 100644
--- a/nix/libutil/spawn.cc
+++ b/nix/libutil/spawn.cc
@@ -51,6 +51,8 @@
51 51
52#ifdef __linux__ 52#ifdef __linux__
53#include <sys/personality.h> 53#include <sys/personality.h>
54#include <linux/seccomp.h>
55#include <linux/filter.h>
54#endif 56#endif
55 57
56#if defined(SYS_pivot_root) 58#if defined(SYS_pivot_root)
@@ -281,6 +283,36 @@ void setIDsAction(SpawnContext & ctx)
281 throw SysError("setuid failed"); 283 throw SysError("setuid failed");
282} 284}
283 285
286void setNoNewPrivsAction(SpawnContext & ctx)
287{
288 if(ctx.setNoNewPrivs)
289#if __linux__ && defined(PR_SET_NO_NEW_PRIVS)
290 if(prctl(PR_SET_NO_NEW_PRIVS, 0, 0, 0, 0) == -1)
291 throw SysError("setting PR_SET_NO_NEW_PRIVS");
292#else
293 throw Error("setting PR_SET_NO_NEW_PRIVS not supported on this system");
294#endif
295}
296
297void addSeccompFilterAction(SpawnContext & ctx)
298{
299 if(ctx.addSeccompFilter) {
300#if __linux__ && defined(PR_SET_SECCOMP) && defined(SECCOMP_MODE_FILTER)
301 /* We use no extra functionality from the seccomp system call, so
302 * just use prctl. */
303 if(ctx.seccompFilter.size() > USHRT_MAX)
304 throw Error("seccomp filter too large");
305 struct sock_fprog prog;
306 prog.len = (unsigned short) ctx.seccompFilter.size();
307 prog.filter = ctx.seccompFilter.data();
308 if(prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) == -1)
309 throw SysError("installing seccomp filter");
310#else
311 throw Error("setting seccomp filter not supported on this system");
312#endif
313 }
314}
315
284 316
285void restoreSIGPIPEAction(SpawnContext & ctx) 317void restoreSIGPIPEAction(SpawnContext & ctx)
286{ 318{
@@ -336,6 +368,8 @@ Phases getBasicSpawnPhases()
336 { "setPersonality", setPersonalityAction }, 368 { "setPersonality", setPersonalityAction },
337 { "oomSacrifice", oomSacrificeAction }, 369 { "oomSacrifice", oomSacrificeAction },
338 { "setIDs", setIDsAction }, 370 { "setIDs", setIDsAction },
371 { "setNoNewPrivs", setNoNewPrivsAction },
372 { "addSeccompFilter", addSeccompFilterAction },
339 { "restoreSIGPIPE", restoreSIGPIPEAction }, 373 { "restoreSIGPIPE", restoreSIGPIPEAction },
340 { "setupSuccess", setupSuccessAction }, 374 { "setupSuccess", setupSuccessAction },
341 { "exec", execAction } }; 375 { "exec", execAction } };
@@ -773,6 +807,8 @@ Phases getCloneSpawnPhases()
773 CloneSpawnContext.lockMountsMapAll = true. */ 807 CloneSpawnContext.lockMountsMapAll = true. */
774 { "lockMounts", lockMountsAction }, 808 { "lockMounts", lockMountsAction },
775 { "setIDs", setIDsAction }, 809 { "setIDs", setIDsAction },
810 { "setNoNewPrivs", setNoNewPrivsAction },
811 { "addSeccompFilter", addSeccompFilterAction },
776 { "restoreSIGPIPE", restoreSIGPIPEAction }, 812 { "restoreSIGPIPE", restoreSIGPIPEAction },
777 { "setupSuccess", setupSuccessAction }, 813 { "setupSuccess", setupSuccessAction },
778 { "exec", execAction }}; 814 { "exec", execAction }};
diff --git a/nix/libutil/spawn.hh b/nix/libutil/spawn.hh
index edc528312db..5e75bcfb097 100644
--- a/nix/libutil/spawn.hh
+++ b/nix/libutil/spawn.hh
@@ -3,6 +3,9 @@
3#include <util.hh> 3#include <util.hh>
4#include <map> 4#include <map>
5#include <stddef.h> 5#include <stddef.h>
6#ifdef __linux__
7#include <linux/filter.h>
8#endif
6 9
7namespace nix { 10namespace nix {
8struct SpawnContext; /* Forward declaration */ 11struct SpawnContext; /* Forward declaration */
@@ -57,6 +60,11 @@ struct SpawnContext {
57 bool dropAmbientCapabilities = false; /* Whether to drop ambient 60 bool dropAmbientCapabilities = false; /* Whether to drop ambient
58 * capabilities if on a system that 61 * capabilities if on a system that
59 * supports them. */ 62 * supports them. */
63 bool setNoNewPrivs = false;
64 bool addSeccompFilter = false;
65#if __linux__
66 std::vector<struct sock_filter> seccompFilter;
67#endif
60 bool doChroot = false; 68 bool doChroot = false;
61 Path chrootRootDir; 69 Path chrootRootDir;
62 void * extraData; /* Extra user data */ 70 void * extraData; /* Extra user data */
@@ -118,6 +126,8 @@ Action closeMostFDsAction;
118Action setPersonalityAction; 126Action setPersonalityAction;
119Action oomSacrificeAction; 127Action oomSacrificeAction;
120Action setIDsAction; 128Action setIDsAction;
129Action setNoNewPrivsAction;
130Action addSeccompFilterAction;
121Action restoreSIGPIPEAction; 131Action restoreSIGPIPEAction;
122Action setupSuccessAction; 132Action setupSuccessAction;
123Action execAction; 133Action execAction;
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-03 07:17:56 +0000