seccomp: Whitelist clock_adjtime

[stanislavlevin]

- What I did
fixes #40919

- How I did it
Allow making the syscall by default seccomp filter.
CAP_SYS_TIME is still required for time adjustment (enforced by the kernel):

kernel/time/posix-timers.c:

1112 SYSCALL_DEFINE2(clock_adjtime, const clockid_t, which_clock,
1113                 struct __kernel_timex __user *, utx)
...
1121         err = do_clock_adjtime(which_clock, &ktx);

1100 int do_clock_adjtime(const clockid_t which_clock, struct __kernel_timex * ktx)
1101 {
...
1109         return kc->clock_adj(which_clock, ktx);

1299 static const struct k_clock clock_realtime = {
...
1304         .clock_adj              = posix_clock_realtime_adj,

188 static int posix_clock_realtime_adj(const clockid_t which_clock,
189                                     struct __kernel_timex *t)
190 {
191         return do_adjtimex(t);

kernel/time/timekeeping.c:

2312 int do_adjtimex(struct __kernel_timex *txc)
2313 {
...
2321         /* Validate the data before disabling interrupts */
2322         ret = timekeeping_validate_timex(txc);

2246 static int timekeeping_validate_timex(const struct __kernel_timex *txc)
2247 {
2248         if (txc->modes & ADJ_ADJTIME) {
...
2252                 if (!(txc->modes & ADJ_OFFSET_READONLY) &&
2253                     !capable(CAP_SYS_TIME))
2254                         return -EPERM;
2255         } else {
2256                 /* In order to modify anything, you gotta be super-user! */
2257                 if (txc->modes && !capable(CAP_SYS_TIME))
2258                         return -EPERM;

- How to verify it
without cap:

1. glibc 2.31 within container
2. run container without CAP_SYS_TIME
3. run chronyd -d within container

Expected result: chronyd should fail to make adjtimex.

with cap:

1. glibc 2.31 within container
2. run container with --cap-add CAP_SYS_TIME
3. run chronyd -d within container

Expected result: chronyd should not fail to make adjtimex.

- Description for the changelog

Whitelist clock_adjtime. CAP_SYS_TIME is still required for time adjustment.

- A picture of a cute animal (not mandatory but encouraged)

[thaJeztah]

Allow making the syscall by default seccomp filter.
CAP_SYS_TIME is still required for time adjustment (enforced by the kernel).

Should this use the same approach as (added in #31966) ?

moby/profiles/seccomp/seccomp_default.go

Lines 641 to 652 in cdf49f3

	{
	Names: []string{
	"settimeofday",
	"stime",
	"clock_settime",
	},
	Action: types.ActAllow,
	Args: []*types.Arg{},
	Includes: types.Filter{
	Caps: []string{"CAP_SYS_TIME"},
	},
	},

IIRC, with that approach seccomp by default blocks these (so both CAP_SYS_TIME and seccomp are blocking them, but once CAP_SYS_TIME is enabled for the container, they're unblocked.

/cc @justincormack

[stanislavlevin]

Allow making the syscall by default seccomp filter.
CAP_SYS_TIME is still required for time adjustment (enforced by the kernel).

Should this use the same approach as (added in #31966) ?

IIRC, with that approach seccomp by default blocks these (so both CAP_SYS_TIME and seccomp are blocking them, but once CAP_SYS_TIME is enabled for the container, they're unblocked.

Related issue: #33126

[thaJeztah]

Related issue: #33126

Ah, thanks for linking that one 👍

[thaJeztah]

LGTM, thanks!

[thaJeztah]

@tonistiigi @cpuguy83 good to go?