[blk-threaded - 9/12] seccomp: add block worker thread filter - #6131
Open
PierreBertholom wants to merge 4 commits into
Open
[blk-threaded - 9/12] seccomp: add block worker thread filter#6131PierreBertholom wants to merge 4 commits into
PierreBertholom wants to merge 4 commits into
Conversation
Reset the shared memfd before each export so a shorter filter cannot retain instructions from the previous filter. Signed-off-by: Pierre Bertholom <pbertho@amazon.com>
Resolve x86 syscall numbers written through partial registers while preserving unaffected bits during backpropagation. Inspect seccomp rules from all thread categories. Signed-off-by: Pierre Bertholom <pbertho@amazon.com>
Add an optional seccomp category and a syscall allowlist for block workers. Keep existing custom filters valid when no block worker is needed. Apply the filter before entering the worker event loop. Signed-off-by: Pierre Bertholom <pbertho@amazon.com>
Document the allowed and mandatory Firecracker thread categories. Explain when custom filters need the optional block worker category. Signed-off-by: Pierre Bertholom <pbertho@amazon.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## pbertho/blk-threaded-08 #6131 +/- ##
===========================================================
- Coverage 81.89% 81.88% -0.01%
===========================================================
Files 278 278
Lines 31592 31606 +14
===========================================================
+ Hits 25871 25882 +11
- Misses 5721 5724 +3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Manciukic
reviewed
Aug 26, 2026
| "syscall": "rt_sigprocmask" | ||
| }, | ||
| { | ||
| "syscall": "rt_sigaction", |
Contributor
There was a problem hiding this comment.
we should also have rt_sigreturn which is used to return from signal handler if it happens to receive a signal in the worker thread. We recently caught a bug where api thread was missing it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[9/12] part of the PR stack starting with #6123
Changes
This pull request contains the seccomp filter and its support changes.
seccompiler: truncate memfd before each BPF export
Reset the shared memfd before each export so a shorter filter cannot
retain instructions from the previous filter.
test: fix x86 regs for seccomp static analysis
Resolve x86 syscall numbers written through partial registers while
preserving unaffected bits during backpropagation.
Inspect seccomp rules from all thread categories.
seccomp: add block worker thread filter
Add an optional seccomp category and a syscall allowlist for block
workers.
Keep existing custom filters valid when no block worker is needed.
Apply the filter before entering the worker event loop.
docs: document seccomp thread categories
Document the allowed and mandatory Firecracker thread categories.
Explain when custom filters need the optional block worker category.