libstore/build: block io_uring

Unfortunately, io_uring is totally opaque to seccomp, and while currently there
are no dangerous operations implemented, there is no guarantee that it remains
this way. This means that io_uring should be blocked entirely to ensure that
the sandbox is future-proof. This has not been observed to cause issues in
practice.

Change-Id: I45d3895f95abe1bc103a63969f444c334dbbf50d

1 files changed, 3 insertions, 3 deletions

diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 33cbfb29d..1dbe66f72 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -1596,9 +1596,9 @@ void setupSeccomp()
     allowSyscall(ctx, SCMP_SYS(ioprio_set));
     allowSyscall(ctx, SCMP_SYS(io_setup));
     allowSyscall(ctx, SCMP_SYS(io_submit));
-    allowSyscall(ctx, SCMP_SYS(io_uring_enter));
-    allowSyscall(ctx, SCMP_SYS(io_uring_register));
-    allowSyscall(ctx, SCMP_SYS(io_uring_setup));
+    // skip io_uring_enter (may become dangerous)
+    // skip io_uring_register (may become dangerous)
+    // skip io_uring_setup (may become dangerous)
     allowSyscall(ctx, SCMP_SYS(ipc));
     allowSyscall(ctx, SCMP_SYS(kcmp));
     allowSyscall(ctx, SCMP_SYS(kexec_file_load));