SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

seccomp: rework functions for parsing system call filters

Browse Source 
This reworks system call filter parsing, and replaces a couple of "bool"
function arguments by a single flags parameter.

This shouldn't change behaviour, except for one case: when we
recursively call our parsing function on our own syscall list, then
we'll lower the log level to LOG_DEBUG from LOG_WARNING, because at that
point things are just a problem in our own code rather than in the user
configuration we are parsing, and we shouldn't hence generate confusing
warnings about syntax errors.

Fixes: #8261
This commit is contained in:
Lennart Poettering
2018-02-27 19:59:09 +01:00
parent fa7bc1d1c7
commit 13d92c6300
4 changed files with 36 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/dbus-execute.c
+2 -2
View File
@@ -1602,7 +1602,7 @@ int bus_exec_context_set_transient_property(
c->syscall_whitelist = whitelist;
if (c->syscall_whitelist) {
r = seccomp_parse_syscall_filter(invert, "@default", -1, c->syscall_filter, true);
r = seccomp_parse_syscall_filter("@default", -1, c->syscall_filter, SECCOMP_PARSE_WHITELIST | (invert ? SECCOMP_PARSE_INVERT : 0));
if (r < 0)
return r;
}
@@ -1616,7 +1616,7 @@ int bus_exec_context_set_transient_property(
if (r < 0)
return r;
r = seccomp_parse_syscall_filter(invert, n, e, c->syscall_filter, c->syscall_whitelist);
r = seccomp_parse_syscall_filter(n, e, c->syscall_filter, (invert ? SECCOMP_PARSE_INVERT : 0) | (c->syscall_whitelist ? SECCOMP_PARSE_WHITELIST : 0));
if (r < 0)
return r;
}