From e657e7d936209ebe2ed5a0cb5fd057810acb508b Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Tue, 17 Jan 2023 09:52:47 +0100 Subject: seitan: find fd of seccomp noitifier from proc Instead of assuming that the fd of the notifier is always 3, find the correct fd from procfs. Signed-off-by: Alice Frosi --- seitan.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 55 insertions(+), 1 deletion(-) diff --git a/seitan.c b/seitan.c index 6c66593..dd4bd9c 100644 --- a/seitan.c +++ b/seitan.c @@ -19,12 +19,15 @@ #include #include #include +#include #include #include #include #include #include #include +#include +#include #include #include #include @@ -181,6 +184,51 @@ static void unblock_eater(int pidfd){ } } +static int find_fd_seccomp_notifier(int pid) +{ + char path[PATH_MAX + 1]; + char entry[2*PATH_MAX + 1]; + char buf[PATH_MAX + 1]; + struct dirent *dp; + ssize_t nbytes; + struct stat sb; + DIR *dirp; + + snprintf(path, sizeof(path), "/proc/%i/fd", pid); + if ((dirp = opendir(path)) == NULL) { + fprintf(stderr,"failed reading fds from proc \n"); + return -1; + } + while ((dp = readdir (dirp)) != NULL) { + snprintf(entry, sizeof(entry), "%s/%s", path, dp->d_name); + if (lstat(entry, &sb) == -1) { + perror("lstat"); + } + /* Skip the entry if it isn't a symbolic link */ + if (!S_ISLNK(sb.st_mode)) + continue; + + nbytes = readlink(entry, buf, PATH_MAX); + if (nbytes == -1) { + perror("readlink"); + } + if (nbytes == PATH_MAX) { + perror("buffer overflow"); + continue; + } + /* + * From man proc: For file descriptors that have no + * corresponding inode (e.g., file descriptors produced by + * bpf(2)..), the entry will be a symbolic link with contents + * of the form: + * anon_inode: + */ + if (strcmp(buf, "anon_inode:seccomp notify") == 0) + return atoi(dp->d_name); + } + return -1; +} + int handle(struct seccomp_notif *req, int notifyfd) { char path[PATH_MAX + 1]; @@ -235,6 +283,7 @@ int main(int argc, char **argv) struct arguments arguments; bool running = true; int fd, epollfd; + int notifierfd; int nevents,i; arguments.pid = -1; @@ -257,7 +306,12 @@ int main(int argc, char **argv) } sleep(1); - if ((notifier = syscall(SYS_pidfd_getfd, pidfd, 3, 0)) < 0) { + if ((notifierfd = find_fd_seccomp_notifier(ret)) < 0){ + fprintf(stderr, "failed getting fd of the notifier\n"); + exit(EXIT_FAILURE); + } + printf("fd notifier: %d \n", notifierfd); + if ((notifier = syscall(SYS_pidfd_getfd, pidfd, notifierfd, 0)) < 0) { perror("pidfd_getfd"); exit(EXIT_FAILURE); } -- cgit v1.2.3