Luca Boccassi
4118674169
io_uring operations bypass several sandboxing settings today. IORING_OP_SOCKET ignores RestrictAddressFamilies=, IORING_OP_OPENAT can create SUID files despite RestrictSUIDSGID=, and SystemCallFilter= doesn't cover any operation that can do the work of a system call it denies. Since Linux 7.0, a task can register classic BPF filters for io_uring operations, and every ring that the task or its children create afterwards inherits them. Let's use them in the executor, so that these three settings also apply to the equivalent io_uring operations. We also add IOUringFilter=, which takes an allow or deny list of io_uring operations, for operations like IORING_OP_URING_CMD that have no system call of their own. "systemd-analyze io-uring-filter" lists the operations and the system calls that SystemCallFilter= maps them to. Once the executor registers io_uring filters, the kernel refuses task-wide IORING_REGISTER_RESTRICTIONS for the service with EPERM. The man pages document that. On older kernels, the existing settings keep their current behavior, and IOUringFilter= denies io_uring_setup() with ENOSYS, so that programs fall back to regular system calls.
System and Service Manager
Details
Most documentation is available on systemd's website.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release