use util::syscall whenever possible

diff --git a/Makefile b/Makefile
index 6749427..156cbcb 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -113,7 +113,7 @@ mnt.o: mnt.h nsjail.h logs.h macros.h subproc.h util.h
 net.o: net.h nsjail.h logs.h subproc.h
 nsjail.o: nsjail.h cmdline.h logs.h macros.h net.h sandbox.h subproc.h util.h
 pid.o: pid.h nsjail.h logs.h subproc.h
-sandbox.o: sandbox.h nsjail.h kafel/include/kafel.h logs.h
+sandbox.o: sandbox.h nsjail.h kafel/include/kafel.h logs.h util.h
 subproc.o: subproc.h nsjail.h cgroup.h contain.h logs.h macros.h net.h
 subproc.o: sandbox.h user.h util.h
 uts.o: uts.h nsjail.h logs.h

diff --git a/caps.cc b/caps.cc
index 07785da..a7e0395 100644 (file)
--- a/caps.cc
+++ b/caps.cc
@@ -112,7 +112,7 @@ static cap_user_data_t getCaps() {
            .version = _LINUX_CAPABILITY_VERSION_3,
            .pid = 0,
        };
-       if (syscall(__NR_capget, &cap_hdr, &cap_data) == -1) {
+       if (util::syscall(__NR_capget, (uintptr_t)&cap_hdr, (uintptr_t)&cap_data) == -1) {
                PLOG_W("capget() failed");
                return NULL;
        }
@@ -124,7 +124,7 @@ static bool setCaps(const cap_user_data_t cap_data) {
            .version = _LINUX_CAPABILITY_VERSION_3,
            .pid = 0,
        };
-       if (syscall(__NR_capset, &cap_hdr, cap_data) == -1) {
+       if (util::syscall(__NR_capset, (uintptr_t)&cap_hdr, (uintptr_t)cap_data) == -1) {
                PLOG_W("capset() failed");
                return false;
        }

diff --git a/mnt.cc b/mnt.cc
index 4da78d6..f6aa412 100644 (file)
--- a/mnt.cc
+++ b/mnt.cc
@@ -37,7 +37,6 @@
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <sys/wait.h>
-#include <syscall.h>
 #include <unistd.h>
 
 #include <memory>
@@ -402,7 +401,8 @@ static bool initNsInternal(nsjconf_t* nsjconf) {
         * providing any special directory for old_root, which is sometimes not easy, given that
         * e.g. /tmp might not always be present inside new_root
         */
-       if (syscall(__NR_pivot_root, destdir->c_str(), destdir->c_str()) == -1) {
+       if (util::syscall(
+               __NR_pivot_root, (uintptr_t)destdir->c_str(), (uintptr_t)destdir->c_str()) == -1) {
                PLOG_E("pivot_root('%s', '%s')", destdir->c_str(), destdir->c_str());
                return false;
        }

diff --git a/sandbox.cc b/sandbox.cc
index d987bfb..1f1ac6c 100644 (file)
--- a/sandbox.cc
+++ b/sandbox.cc
@@ -33,6 +33,7 @@ extern "C" {
 #include "kafel.h"
 }
 #include "logs.h"
+#include "util.h"
 
 namespace sandbox {
 
@@ -65,9 +66,9 @@ static bool prepareAndCommit(nsjconf_t* nsjconf) {
                    "too old?)");
                return false;
 #else
-               if (syscall(__NR_seccomp, (uintptr_t)SECCOMP_SET_MODE_FILTER,
+               if (util::syscall(__NR_seccomp, (uintptr_t)SECCOMP_SET_MODE_FILTER,
                        (uintptr_t)(SECCOMP_FILTER_FLAG_TSYNC | SECCOMP_FILTER_FLAG_LOG),
-                       &nsjconf->seccomp_fprog) == -1) {
+                       (uintptr_t)&nsjconf->seccomp_fprog) == -1) {
                        PLOG_E(
                            "seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC | "
                            "SECCOMP_FILTER_FLAG_LOG) failed");

diff --git a/subproc.cc b/subproc.cc
index 2767307..aafb629 100644 (file)
--- a/subproc.cc
+++ b/subproc.cc
@@ -181,10 +181,10 @@ static void subprocNewProc(nsjconf_t* nsjconf, int fd_in, int fd_out, int fd_err
 
        if (nsjconf->use_execveat) {
 #if defined(__NR_execveat)
-               syscall(__NR_execveat, (uintptr_t)nsjconf->exec_fd, "", (char* const*)argv.data(),
-                   environ, (uintptr_t)AT_EMPTY_PATH);
+               util::syscall(__NR_execveat, nsjconf->exec_fd, (uintptr_t) "",
+                   (uintptr_t)argv.data(), (uintptr_t)environ, AT_EMPTY_PATH);
 #else  /* defined(__NR_execveat) */
-               LOG_E("Your system doesn't support execveat() syscall");
+               LOG_E("Your system doesn't support execveat() util::syscall");
                return;
 #endif /* defined(__NR_execveat) */
        } else {
@@ -202,7 +202,7 @@ static void addProc(nsjconf_t* nsjconf, pid_t pid, int sock) {
        p.remote_txt = net::connToText(sock, /* remote= */ true, &p.remote_addr);
 
        char fname[PATH_MAX];
-       snprintf(fname, sizeof(fname), "/proc/%d/syscall", (int)pid);
+       snprintf(fname, sizeof(fname), "/proc/%d/util::syscall", (int)pid);
        p.pid_syscall_fd = TEMP_FAILURE_RETRY(open(fname, O_RDONLY | O_CLOEXEC));
 
        nsjconf->pids.push_back(p);
@@ -250,7 +250,8 @@ static const pids_t* getPidElem(nsjconf_t* nsjconf, pid_t pid) {
 }
 
 static void seccompViolation(nsjconf_t* nsjconf, siginfo_t* si) {
-       LOG_W("pid=%d commited a syscall/seccomp violation and exited with SIGSYS", si->si_pid);
+       LOG_W(
+           "pid=%d commited a util::syscall/seccomp violation and exited with SIGSYS", si->si_pid);
 
        const pids_t* p = getPidElem(nsjconf, si->si_pid);
        if (p == NULL) {

diff --git a/user.cc b/user.cc
index 4053884..a395f05 100644 (file)
--- a/user.cc
+++ b/user.cc
@@ -48,12 +48,12 @@ namespace user {
 static bool setResGid(gid_t gid) {
        LOG_D("setresgid(%d)", gid);
 #if defined(__NR_setresgid32)
-       if (syscall(__NR_setresgid32, (uintptr_t)gid, (uintptr_t)gid, (uintptr_t)gid) == -1) {
+       if (util::syscall(__NR_setresgid32, (uintptr_t)gid, (uintptr_t)gid, (uintptr_t)gid) == -1) {
                PLOG_W("setresgid32(%d)", (int)gid);
                return false;
        }
 #else  /* defined(__NR_setresgid32) */
-       if (syscall(__NR_setresgid, (uintptr_t)gid, (uintptr_t)gid, (uintptr_t)gid) == -1) {
+       if (util::syscall(__NR_setresgid, (uintptr_t)gid, (uintptr_t)gid, (uintptr_t)gid) == -1) {
                PLOG_W("setresgid(%d)", gid);
                return false;
        }
@@ -64,12 +64,12 @@ static bool setResGid(gid_t gid) {
 static bool setResUid(uid_t uid) {
        LOG_D("setresuid(%d)", uid);
 #if defined(__NR_setresuid32)
-       if (syscall(__NR_setresuid32, (uintptr_t)uid, (uintptr_t)uid, (uintptr_t)uid) == -1) {
+       if (util::syscall(__NR_setresuid32, (uintptr_t)uid, (uintptr_t)uid, (uintptr_t)uid) == -1) {
                PLOG_W("setresuid32(%d)", (int)uid);
                return false;
        }
 #else  /* defined(__NR_setresuid32) */
-       if (syscall(__NR_setresuid, (uintptr_t)uid, (uintptr_t)uid, (uintptr_t)uid) == -1) {
+       if (util::syscall(__NR_setresuid, (uintptr_t)uid, (uintptr_t)uid, (uintptr_t)uid) == -1) {
                PLOG_W("setresuid(%d)", uid);
                return false;
        }