mirror of
https://github.com/checkpoint-restore/criu.git
synced 2026-07-30 05:21:57 +00:00
221af18ea0
This commit adds basic support for dumping and restoring seccomp filters via the new ptrace interface. There are two current known limitations with this approach: 1. This approach doesn't support restoring tasks who first do a seccomp() and then a setuid(); the test elaborates on this and I don't think it is tough to do, but it is not done yet. 2. Filters are compared via memcmp(), so two tasks which have the same parent task and install identical (via memory) filters will have those filters considered to be the "same". Since we force all tasks to have the same creds (including seccomp filters) right now, this isn't a problem. The approach used here is very similar to the cgroup approach: the actual filters are stored in a seccomp.img, and each task has an id that points to the part of the filter tree it needs to restore. This keeps us from dumping the same filter multiple times, since filters are inherited on fork. v2: * remove unused seccomp_filters field from struct rst_info * rework memory layout for passing filters to restorer blob * add a sanity check when finding inherited filters Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
98 lines
2.2 KiB
Protocol Buffer
98 lines
2.2 KiB
Protocol Buffer
import "core-x86.proto";
|
|
import "core-arm.proto";
|
|
import "core-aarch64.proto";
|
|
import "core-ppc64.proto";
|
|
|
|
import "rlimit.proto";
|
|
import "timer.proto";
|
|
|
|
import "siginfo.proto";
|
|
|
|
import "opts.proto";
|
|
|
|
/*
|
|
* These match the SECCOMP_MODE_* flags from <linux/seccomp.h>.
|
|
*/
|
|
enum seccomp_mode {
|
|
disabled = 0;
|
|
strict = 1;
|
|
filter = 2;
|
|
};
|
|
|
|
message task_core_entry {
|
|
required uint32 task_state = 1;
|
|
required uint32 exit_code = 2;
|
|
|
|
required uint32 personality = 3;
|
|
required uint32 flags = 4;
|
|
required uint64 blk_sigset = 5[(criu).hex = true];
|
|
|
|
required string comm = 6;
|
|
|
|
optional task_timers_entry timers = 7;
|
|
optional task_rlimits_entry rlimits = 8;
|
|
|
|
optional uint32 cg_set = 9;
|
|
|
|
optional signal_queue_entry signals_s = 10;
|
|
|
|
optional seccomp_mode seccomp_mode = 11;
|
|
optional uint32 seccomp_filter = 12;
|
|
}
|
|
|
|
message task_kobj_ids_entry {
|
|
required uint32 vm_id = 1;
|
|
required uint32 files_id = 2;
|
|
required uint32 fs_id = 3;
|
|
required uint32 sighand_id = 4;
|
|
|
|
optional uint32 pid_ns_id = 5;
|
|
optional uint32 net_ns_id = 6;
|
|
optional uint32 ipc_ns_id = 7;
|
|
optional uint32 uts_ns_id = 8;
|
|
optional uint32 mnt_ns_id = 9;
|
|
optional uint32 user_ns_id = 10;
|
|
}
|
|
|
|
message thread_sas_entry {
|
|
required uint64 ss_sp = 1;
|
|
required uint64 ss_size = 2;
|
|
required uint32 ss_flags = 3;
|
|
}
|
|
|
|
message thread_core_entry {
|
|
required uint64 futex_rla = 1;
|
|
required uint32 futex_rla_len = 2;
|
|
optional sint32 sched_nice = 3;
|
|
optional uint32 sched_policy = 4;
|
|
optional uint32 sched_prio = 5;
|
|
optional uint64 blk_sigset = 6;
|
|
optional thread_sas_entry sas = 7;
|
|
optional uint32 pdeath_sig = 8;
|
|
|
|
optional signal_queue_entry signals_p = 9;
|
|
}
|
|
|
|
message task_rlimits_entry {
|
|
repeated rlimit_entry rlimits = 1;
|
|
};
|
|
|
|
message core_entry {
|
|
enum march {
|
|
UNKNOWN = 0;
|
|
X86_64 = 1;
|
|
ARM = 2;
|
|
AARCH64 = 3;
|
|
PPC64 = 4;
|
|
}
|
|
|
|
required march mtype = 1;
|
|
optional thread_info_x86 thread_info = 2;
|
|
optional thread_info_arm ti_arm = 6;
|
|
optional thread_info_aarch64 ti_aarch64 = 8;
|
|
optional thread_info_ppc64 ti_ppc64 = 9;
|
|
|
|
optional task_core_entry tc = 3;
|
|
optional task_kobj_ids_entry ids = 4;
|
|
optional thread_core_entry thread_core = 5;
|
|
}
|