SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

shared/seccomp-util: added functionality to make list of filtred syscalls

Browse Source 
While at it, start removing the "seccomp_" prefix from our
own functions. It is used by libseccomp.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek
2020-08-24 20:05:09 +02:00
parent 752fedbea7
commit 000c05207d
3 changed files with 46 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nspawn/nspawn-seccomp.c
+7 -2
View File
@@ -146,13 +146,18 @@ static int seccomp_add_default_syscall_filter(
if (allow_list[i].capability != 0 && (cap_list_retain & (1ULL << allow_list[i].capability)) == 0)
continue;
r = seccomp_add_syscall_filter_item(ctx, allow_list[i].name, SCMP_ACT_ALLOW, syscall_deny_list, false);
r = seccomp_add_syscall_filter_item(ctx,
allow_list[i].name,
SCMP_ACT_ALLOW,
syscall_deny_list,
false,
NULL);
if (r < 0)
return log_error_errno(r, "Failed to add syscall filter item %s: %m", allow_list[i].name);
}
STRV_FOREACH(p, syscall_allow_list) {
r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_deny_list, true);
r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_deny_list, true, NULL);
if (r < 0)
log_warning_errno(r, "Failed to add rule for system call %s on %s, ignoring: %m",
*p, seccomp_arch_to_string(arch));