From 2d26f46559240bcf6fd80af07fed2393f8a1605d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Tue, 5 Aug 2025 10:29:33 -0700 Subject: [PATCH] clatd: x86-32 allow socketcall() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 32-bit x86 has a crazy networking calling convention and instead of using individual system calls has a single multiplexed socketcall() bionic hasn't finished transitioning to the individual calls yet which were added to Linux kernels around the 4.10-4.14-ish timeframe. This does open a bit of security hole, since it effectively allows all 20-ish networking system calls, but oh well, better than constantly allowing & logging. I don't think we'll ever want to enable KILL mode on x86-32 any way. Test: TreeHugger Flag: EXEMPT mainline & disabled code Signed-off-by: Maciej Żenczykowski Change-Id: I7228132cfbf716592607d010f64d5adeeb4419aa --- clatd/main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/clatd/main.c b/clatd/main.c index 8fc9edaf08..6db167919d 100644 --- a/clatd/main.c +++ b/clatd/main.c @@ -139,6 +139,9 @@ void enable_seccomp(void) { BPF2_SECCOMP_ALLOW_IF_EQUAL(__NR_sendmsg), // 211 BPF2_SECCOMP_ALLOW_IF_EQUAL(__NR_recvmsg), // 212 BPF2_SECCOMP_ALLOW_IF_EQUAL(__NR_writev), // 66 +#if defined(__i386__) + BPF2_SECCOMP_ALLOW_IF_EQUAL(__NR_socketcall), // x86-32 only +#endif // logging: getuid writev BPF2_SECCOMP_ALLOW_IF_EQUAL(__NR_getuid), // 174