From f635717d44d735161f0a6bdb372d494fce31617c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 07:13:06 +0000 Subject: [PATCH 1/2] build(deps): bump seccompiler from 0.4.0 to 0.5.0 Bumps [seccompiler](https://github.com/rust-vmm/seccompiler) from 0.4.0 to 0.5.0. - [Release notes](https://github.com/rust-vmm/seccompiler/releases) - [Changelog](https://github.com/rust-vmm/seccompiler/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-vmm/seccompiler/compare/v0.4.0...v0.5.0) --- updated-dependencies: - dependency-name: seccompiler dependency-version: 0.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- Cargo.lock | 13 ++----------- src/cortex-linux-sandbox/Cargo.toml | 2 +- 2 files changed, 3 insertions(+), 12 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 281fe929..356e51b1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1309,7 +1309,7 @@ dependencies = [ "cortex-common", "landlock", "libc", - "seccompiler 0.4.0", + "seccompiler", "serde", "serde_json", "tracing", @@ -1541,7 +1541,7 @@ dependencies = [ "dirs 6.0.0", "landlock", "libc", - "seccompiler 0.5.0", + "seccompiler", "serde", "thiserror 2.0.20", "windows 0.58.0", @@ -5966,15 +5966,6 @@ dependencies = [ "tendril", ] -[[package]] -name = "seccompiler" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "345a3e4dddf721a478089d4697b83c6c0a8f5bf16086f6c13397e4534eb6e2e5" -dependencies = [ - "libc", -] - [[package]] name = "seccompiler" version = "0.5.0" diff --git a/src/cortex-linux-sandbox/Cargo.toml b/src/cortex-linux-sandbox/Cargo.toml index eb060cc3..21ebd2bd 100644 --- a/src/cortex-linux-sandbox/Cargo.toml +++ b/src/cortex-linux-sandbox/Cargo.toml @@ -38,7 +38,7 @@ tracing = { workspace = true } landlock = { workspace = true } # Seccomp -seccompiler = "0.4" +seccompiler = "0.5" # Linux libc bindings libc = { workspace = true } From 48e38d9fd0bc6a691611e92ba22cdaa7f1897e13 Mon Sep 17 00:00:00 2001 From: echobt <154886644+echobt@users.noreply.github.com> Date: Mon, 7 Sep 2026 11:00:41 +0000 Subject: [PATCH 2/2] fix(deps): validate and inherit workspace seccompiler Remove the obsolete 0.4 compatibility exception and inherit the shared 0.5 dependency. Replace the empty filter test with a real subprocess check for denied network sockets and allowed local socket read/write. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> --- .quality/dependency-compatibility.json | 4 -- src/cortex-linux-sandbox/Cargo.toml | 2 +- src/cortex-linux-sandbox/src/seccomp.rs | 56 ++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 10 deletions(-) diff --git a/.quality/dependency-compatibility.json b/.quality/dependency-compatibility.json index 0f2885fe..3279ced3 100644 --- a/.quality/dependency-compatibility.json +++ b/.quality/dependency-compatibility.json @@ -31,10 +31,6 @@ "declaration": "1", "reason": "Retains the existing thiserror 1 derive API until its consumers are migrated together." }, - "src/cortex-linux-sandbox/Cargo.toml:target.cfg(target_os = \"linux\").dependencies:seccompiler": { - "declaration": "0.4", - "reason": "Retains seccompiler 0.4 sandbox filter API; changing sandbox policy needs a dedicated compatibility review." - }, "src/cortex-resume/Cargo.toml:dependencies:thiserror": { "declaration": "1", "reason": "Retains the existing thiserror 1 derive API until its consumers are migrated together." diff --git a/src/cortex-linux-sandbox/Cargo.toml b/src/cortex-linux-sandbox/Cargo.toml index 21ebd2bd..8274c719 100644 --- a/src/cortex-linux-sandbox/Cargo.toml +++ b/src/cortex-linux-sandbox/Cargo.toml @@ -38,7 +38,7 @@ tracing = { workspace = true } landlock = { workspace = true } # Seccomp -seccompiler = "0.5" +seccompiler = { workspace = true } # Linux libc bindings libc = { workspace = true } diff --git a/src/cortex-linux-sandbox/src/seccomp.rs b/src/cortex-linux-sandbox/src/seccomp.rs index 341e5a74..62ab5e23 100644 --- a/src/cortex-linux-sandbox/src/seccomp.rs +++ b/src/cortex-linux-sandbox/src/seccomp.rs @@ -99,12 +99,58 @@ pub fn apply_network_filter() -> Result<()> { #[cfg(test)] mod tests { - // Note: seccomp tests are tricky because they affect the current process - // and are irreversible. Integration tests should be done in a subprocess. + use std::fs::File; + use std::io::{Read, Write}; + use std::net::{TcpListener, UdpSocket}; + use std::os::fd::OwnedFd; + use std::os::unix::net::UnixStream; + use std::process::Command; #[test] - fn test_filter_creation() { - // This test just verifies the filter can be created without panic - // Actual application would need to be tested in a subprocess + fn test_network_filter_in_subprocess() { + const CHILD: &str = "CORTEX_SECCOMP_TEST_CHILD"; + if std::env::var_os(CHILD).is_none() { + let output = Command::new(std::env::current_exe().unwrap()) + .args([ + "--exact", + "seccomp::tests::test_network_filter_in_subprocess", + "--nocapture", + ]) + .env(CHILD, "1") + .output() + .unwrap(); + assert!( + output.status.success(), + "seccomp child failed: {}", + String::from_utf8_lossy(&output.stderr) + ); + assert!( + String::from_utf8_lossy(&output.stdout).contains("1 passed; 0 failed"), + "the isolated seccomp test must actually run" + ); + return; + } + + // Prove the denied operations work before installing this filter. + drop(TcpListener::bind("127.0.0.1:0").unwrap()); + drop(UdpSocket::bind("127.0.0.1:0").unwrap()); + super::apply_network_filter().unwrap(); + + assert_eq!( + TcpListener::bind("127.0.0.1:0").unwrap_err().raw_os_error(), + Some(libc::EPERM) + ); + assert_eq!( + UdpSocket::bind("127.0.0.1:0").unwrap_err().raw_os_error(), + Some(libc::EPERM) + ); + let (sender, receiver) = UnixStream::pair().unwrap(); + // Use read/write: the filter intentionally denies send/recv syscalls. + let mut sender = File::from(OwnedFd::from(sender)); + let mut receiver = File::from(OwnedFd::from(receiver)); + sender.write_all(b"local").unwrap(); + let mut received = [0; 5]; + receiver.read_exact(&mut received).unwrap(); + assert_eq!(&received, b"local"); } }