syd 3.58.0

rock-solid application kernel
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109

//
// Syd: rock-solid application kernel
// src/kernel/epoll.rs: epoll(7) family syscall handlers
//
// Copyright (c) 2023, 2024, 2025, 2026 Ali Polatel <alip@chesswob.org>
//
// SPDX-License-Identifier: GPL-3.0

use libc::c_int;
use libseccomp::ScmpNotifResp;
use nix::{errno::Errno, sys::epoll::EpollCreateFlags};

use crate::{
    cookie::{safe_epoll_create, safe_exit_group},
    log_enabled,
    path::XPath,
    req::UNotifyEventRequest,
    sandbox::{Action, Capability, SandboxGuard},
    syslog::LogLevel,
    warn, xfmt,
};

pub(crate) fn sys_epoll_create(request: UNotifyEventRequest) -> ScmpNotifResp {
    syscall_handler!(request, |request: UNotifyEventRequest| {
        // Linux truncates upper bits.
        #[expect(clippy::cast_possible_truncation)]
        let size = request.scmpreq.data.args[0] as c_int;

        // Linux requires a positive size argument.
        if size <= 0 {
            return Err(Errno::EINVAL);
        }

        handle_epoll_create(&request, false)
    })
}

pub(crate) fn sys_epoll_create1(request: UNotifyEventRequest) -> ScmpNotifResp {
    syscall_handler!(request, |request: UNotifyEventRequest| {
        let flags = to_epoll_create_flags(request.scmpreq.data.args[0])?;
        handle_epoll_create(&request, flags.contains(EpollCreateFlags::EPOLL_CLOEXEC))
    })
}

fn handle_epoll_create(
    request: &UNotifyEventRequest,
    cloexec: bool,
) -> Result<ScmpNotifResp, Errno> {
    let sandbox = request.get_sandbox();
    let force_cloexec = sandbox.flags.force_cloexec();
    let force_rand_fd = sandbox.flags.force_rand_fd();
    sandbox_epoll_create(request, &sandbox)?;
    drop(sandbox); // release the read lock.

    let cloexec = force_cloexec || cloexec;
    let fd = safe_epoll_create()?;

    request.send_fd(fd, cloexec, force_rand_fd)
}

#[expect(clippy::cognitive_complexity)]
fn sandbox_epoll_create(
    request: &UNotifyEventRequest,
    sandbox: &SandboxGuard<'_>,
) -> Result<(), Errno> {
    let caps = Capability::CAP_CREATE;
    let name = XPath::from_bytes(b"!epoll");

    if sandbox.getcaps(caps).is_empty() {
        // Sandboxing is off.
        return Ok(());
    }
    let action = sandbox.check_name(caps, name);

    if action.is_logging() && log_enabled!(LogLevel::Warn) {
        if sandbox.log_scmp() {
            warn!("ctx": "access", "cap": caps, "act": action,
                "sys": request.syscall, "path": name,
                "tip": xfmt!("configure `allow/{caps}+{name}'"),
                "req": request);
        } else {
            warn!("ctx": "access", "cap": caps, "act": action,
                "sys": request.syscall, "path": name,
                "tip": xfmt!("configure `allow/{caps}+{name}'"),
                "pid": request.scmpreq.pid);
        }
    }

    match action {
        Action::Allow | Action::Warn => Ok(()),
        Action::Deny | Action::Filter => Err(Errno::ENOMEM),
        Action::Panic => panic!(),
        Action::Exit => safe_exit_group(Errno::ENOMEM as i32),
        action => {
            // Stop|Kill
            let _ = request.kill(action);
            Err(Errno::ENOMEM)
        }
    }
}

fn to_epoll_create_flags(arg: u64) -> Result<EpollCreateFlags, Errno> {
    // Linux truncates upper bits.
    #[expect(clippy::cast_possible_truncation)]
    let flags = arg as c_int;

    // Reject invalid bits.
    EpollCreateFlags::from_bits(flags).ok_or(Errno::EINVAL)
}