{"action":"closed","issue":{"url":"https://api.github.com/repos/seccomp/libseccomp/issues/8","labels_url":"https://api.github.com/repos/seccomp/libseccomp/issues/8/labels{/name}","comments_url":"https://api.github.com/repos/seccomp/libseccomp/issues/8/comments","events_url":"https://api.github.com/repos/seccomp/libseccomp/issues/8/events","html_url":"https://github.com/seccomp/libseccomp/issues/8","id":92135852,"number":8,"title":"Socket filtering broken on x86","user":{"login":"dbnicholson","id":6495518,"avatar_url":"https://avatars.githubusercontent.com/u/6495518?v=3","gravatar_id":"","url":"https://api.github.com/users/dbnicholson","html_url":"https://github.com/dbnicholson","followers_url":"https://api.github.com/users/dbnicholson/followers","following_url":"https://api.github.com/users/dbnicholson/following{/other_user}","gists_url":"https://api.github.com/users/dbnicholson/gists{/gist_id}","starred_url":"https://api.github.com/users/dbnicholson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dbnicholson/subscriptions","organizations_url":"https://api.github.com/users/dbnicholson/orgs","repos_url":"https://api.github.com/users/dbnicholson/repos","events_url":"https://api.github.com/users/dbnicholson/events{/privacy}","received_events_url":"https://api.github.com/users/dbnicholson/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"pcmoore","id":8494929,"avatar_url":"https://avatars.githubusercontent.com/u/8494929?v=3","gravatar_id":"","url":"https://api.github.com/users/pcmoore","html_url":"https://github.com/pcmoore","followers_url":"https://api.github.com/users/pcmoore/followers","following_url":"https://api.github.com/users/pcmoore/following{/other_user}","gists_url":"https://api.github.com/users/pcmoore/gists{/gist_id}","starred_url":"https://api.github.com/users/pcmoore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcmoore/subscriptions","organizations_url":"https://api.github.com/users/pcmoore/orgs","repos_url":"https://api.github.com/users/pcmoore/repos","events_url":"https://api.github.com/users/pcmoore/events{/privacy}","received_events_url":"https://api.github.com/users/pcmoore/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-06-30T16:21:39Z","updated_at":"2015-06-30T17:09:38Z","closed_at":"2015-06-30T17:09:38Z","body":"I'm trying to filter socket families, but it seems to be broken on x86. Filtering any family will cause AF_UNIX (all?) to be blocked. Here's my simple program trying to open the X socket.\r\n```\r\n#include <stdlib.h>\r\n#include <stdio.h>\r\n#include <string.h>\r\n#include <errno.h>\r\n#include <fcntl.h>\r\n#include <seccomp.h>\r\n#include <sys/stat.h>\r\n#include <sys/types.h>\r\n#include <sys/socket.h>\r\n#include <X11/Xlib.h>\r\n\r\n/* Build with:\r\n * $CC -o seccomp seccomp.c `pkg-config --cflags --libs libseccomp x11`\r\n */\r\n\r\nint main(int argc, char *argv[])\r\n{\r\n  scmp_filter_ctx seccomp;\r\n  int family = AF_VSOCK; /* any non AF_UNIX family */\r\n  int ret;\r\n  Display *dpy;\r\n\r\n  seccomp = seccomp_init(SCMP_ACT_ALLOW);\r\n  if (!seccomp)\r\n    {\r\n      fprintf(stderr, \"Could not initialize seccomp\\n\");\r\n      exit(1);\r\n    }\r\n\r\n  ret = seccomp_arch_add(seccomp, SCMP_ARCH_X86);\r\n  if (ret < 0 && ret != -EEXIST)\r\n    {\r\n      fprintf(stderr, \"Failed to add x86 seccomp arch: %s\\n\",\r\n              strerror(-ret));\r\n    }\r\n\r\n  ret = seccomp_rule_add(seccomp, SCMP_ACT_ERRNO(EAFNOSUPPORT),\r\n                         SCMP_SYS(socket), 1,\r\n                         SCMP_A0(SCMP_CMP_EQ, family));\r\n  if (ret < 0)\r\n    {\r\n      fprintf(stderr, \"Failed to block socket family %d: %s\\n\", family,\r\n              strerror(-ret));\r\n      exit(1);\r\n    }\r\n\r\n  ret = seccomp_load(seccomp);\r\n  if (ret < 0)\r\n    {\r\n      fprintf(stderr, \"Failed to load seccomp filter: %s\\n\", strerror(-ret));\r\n      exit(1);\r\n    }\r\n\r\n  dpy = XOpenDisplay(NULL);\r\n  if (!dpy)\r\n    {\r\n      fprintf(stderr, \"Failed to open X display: %s\\n\", strerror(errno));\r\n      exit(1);\r\n    }\r\n\r\n  printf(\"X displayed opened!\\n\");\r\n  return 0;\r\n}\r\n```\r\nI'm using libseccomp master. Building as a 64 bit program, everything works fine. Building as a 32 bit program, I get `Failed to open X display: Address family not supported by protocol`. I've tried this on a couple systems. One is Fedora 20 running a 64 bit kernel on both 64 and 32 bit userspace. The other is on a debian style system with 32 bit userspace. In both cases, the kernel is a bit old, but I'm not sure that's the issue since the 64 bit program works. On Fedora 20, the kernel is 3.19.3. On the debian style system, the kernel is based on Ubuntu's 3.16 series, but I've also run it in a chroot on the Fedora 20 system.\r\n\r\nAny ideas?"}}