diff options
| author | alois31 <alois1@gmx-topmail.de> | 2024-07-26 07:08:35 +0000 |
|---|---|---|
| committer | Gerrit Code Review <gerrit@localhost> | 2024-07-26 07:08:35 +0000 |
| commit | d945e89e19bb508133bc563fb960b1cf1e785410 (patch) | |
| tree | 6a29d77bb1f08e437651163ef58c0063ee0ac2a1 /maintainers | |
| parent | 60a48311e84c228e664a44c8d049ea3080879a40 (diff) | |
| parent | e7188e211a5a2ac0ba34635a846569560bb5f000 (diff) | |
Merge changes I45d3895f,I541be3ea,Ibe51416d into main
* changes:
libstore/build: block io_uring
libstore/build: use an allowlist approach to syscall filtering
libstore/build: always treat seccomp setup failures as fatal
Diffstat (limited to 'maintainers')
| -rw-r--r-- | maintainers/check-syscalls.nix | 16 | ||||
| -rwxr-xr-x | maintainers/check-syscalls.sh | 7 |
2 files changed, 23 insertions, 0 deletions
diff --git a/maintainers/check-syscalls.nix b/maintainers/check-syscalls.nix new file mode 100644 index 000000000..1a3de5c6d --- /dev/null +++ b/maintainers/check-syscalls.nix @@ -0,0 +1,16 @@ +{ + runCommandNoCC, + lib, + libseccomp, + writeShellScriptBin, +}: +let + syscalls-csv = runCommandNoCC "syscalls.csv" { } '' + echo ${lib.escapeShellArg libseccomp.src} + tar -xf ${lib.escapeShellArg libseccomp.src} --strip-components=2 ${libseccomp.name}/src/syscalls.csv + mv syscalls.csv "$out" + ''; +in +writeShellScriptBin "check-syscalls" '' + ${./check-syscalls.sh} ${syscalls-csv} +'' diff --git a/maintainers/check-syscalls.sh b/maintainers/check-syscalls.sh new file mode 100755 index 000000000..cd72ac23b --- /dev/null +++ b/maintainers/check-syscalls.sh @@ -0,0 +1,7 @@ +#!/usr/bin/env bash + +set -e + +diff -u <(awk < src/libstore/build/local-derivation-goal.cc '/BEGIN extract-syscalls/ { extracting = 1; next } +match($0, /allowSyscall\(ctx, SCMP_SYS\(([^)]*)\)\);|\/\/ skip ([^ ]*)/, result) { print result[1] result[2] } +/END extract-syscalls/ { extracting = 0; next }') <(tail -n+2 "$1" | cut -d, -f 1) |