mirror of
https://github.com/systemd/systemd.git
synced 2026-11-06 05:17:24 +00:00
Luca Boccassi
4118674169
io_uring operations bypass several sandboxing settings today. IORING_OP_SOCKET ignores RestrictAddressFamilies=, IORING_OP_OPENAT can create SUID files despite RestrictSUIDSGID=, and SystemCallFilter= doesn't cover any operation that can do the work of a system call it denies. Since Linux 7.0, a task can register classic BPF filters for io_uring operations, and every ring that the task or its children create afterwards inherits them. Let's use them in the executor, so that these three settings also apply to the equivalent io_uring operations. We also add IOUringFilter=, which takes an allow or deny list of io_uring operations, for operations like IORING_OP_URING_CMD that have no system call of their own. "systemd-analyze io-uring-filter" lists the operations and the system calls that SystemCallFilter= maps them to. Once the executor registers io_uring filters, the kernel refuses task-wide IORING_REGISTER_RESTRICTIONS for the service with EPERM. The man pages document that. On older kernels, the existing settings keep their current behavior, and IOUringFilter= denies io_uring_setup() with ENOSYS, so that programs fall back to regular system calls.