SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nspawn: prohibit access to the kernel log buffer by default

Browse Source 
Unless CAP_SYSLOG is explicitly passed block all access to kmg
This commit is contained in:
Lennart Poettering
2015-05-21 20:49:24 +02:00
parent 4c6d20dece
commit 5ba7a26847
1 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nspawn/nspawn.c
+10 -9
View File
@@ -2932,15 +2932,16 @@ static int setup_seccomp(void) {
uint64_t capability;
int syscall_num;
} blacklist[] = {
{ CAP_SYS_RAWIO, SCMP_SYS(iopl)},
{ CAP_SYS_RAWIO, SCMP_SYS(ioperm)},
{ CAP_SYS_BOOT, SCMP_SYS(kexec_load)},
{ CAP_SYS_ADMIN, SCMP_SYS(swapon)},
{ CAP_SYS_ADMIN, SCMP_SYS(swapoff)},
{ CAP_SYS_ADMIN, SCMP_SYS(open_by_handle_at)},
{ CAP_SYS_MODULE, SCMP_SYS(init_module)},
{ CAP_SYS_MODULE, SCMP_SYS(finit_module)},
{ CAP_SYS_MODULE, SCMP_SYS(delete_module)},
{ CAP_SYS_RAWIO, SCMP_SYS(iopl) },
{ CAP_SYS_RAWIO, SCMP_SYS(ioperm) },
{ CAP_SYS_BOOT, SCMP_SYS(kexec_load) },
{ CAP_SYS_ADMIN, SCMP_SYS(swapon) },
{ CAP_SYS_ADMIN, SCMP_SYS(swapoff) },
{ CAP_SYS_ADMIN, SCMP_SYS(open_by_handle_at) },
{ CAP_SYS_MODULE, SCMP_SYS(init_module) },
{ CAP_SYS_MODULE, SCMP_SYS(finit_module) },
{ CAP_SYS_MODULE, SCMP_SYS(delete_module) },
{ CAP_SYSLOG, SCMP_SYS(syslog) },
};
scmp_filter_ctx seccomp;