ValveSoftware / ValveSoftware/wine
Seccomp isn't applied if wine is already confined
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 2k
- Forks
- 488
- PR merge metrics
- No merged PRs in 30d
Description
If wine process is already confined externally (e.g. with some container sandbox like flatpak, LXC, docker, etc), it's own seccomp filters are never applied.
It comes from this check:
https://github.com/ValveSoftware/wine/blob/b48ce9a2778a4ff7ee14067f0ea73693ed70c52d/dlls/ntdll/unix/signal_x86_64.c#L2180
https://github.com/ValveSoftware/wine/blob/b48ce9a2778a4ff7ee14067f0ea73693ed70c52d/dlls/ntdll/unix/signal_x86_64.c#L2199-L2200
Since seccomp filters are stackable and are optimized with BPF-JIT, I believe they should be applied unconditionally, and only skipped if there was an actual error (prctl manpage say that PR_GET_SECCOMP returns negative value on error).
See flathub/com.valvesoftware.Steam#608 for more details.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in dlls/ntdll/unix/signal_x86_64.c at the linked checks around lines 2180 and 2199-2200, then read the prctl PR_GET_SECCOMP behavior and the surrounding seccomp setup. Confirm that an externally confined Wine process still receives its own filters while genuine prctl errors remain handled as errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100