SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nspawn: implement configurable syscall whitelisting/blacklisting

Browse Source 
Now that we have ported nspawn's seccomp code to the generic code in
seccomp-util, let's extend it to support whitelisting and blacklisting
of specific additional syscalls.

This uses similar syntax as PID1's support for system call filtering,
but in contrast to that always implements a blacklist (and not a
whitelist), as we prepopulate the filter with a blacklist, and the
unit's system call filter logic does not come with anything
prepopulated.

(Later on we might actually want to invert the logic here, and
whitelist rather than blacklist things, but at this point let's not do
that. In case we switch this over later, the syscall add/remove logic of
this commit should be compatible conceptually.)

Fixes: #5163

Replaces: #5944
This commit is contained in:
Lennart Poettering
2017-09-12 14:06:21 +02:00
parent 7609340e2f
commit 960e4569e1
10 changed files with 169 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.nspawn.xml
+14 -4
View File
@@ -274,11 +274,21 @@
<varlistentry>
<term><varname>NotifyReady=</varname></term>
<listitem><para>Configures support for notifications from the container's init process.
This is equivalent to use <option>--notify-ready=</option> command line switch,
and takes the same options. See <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
for details about the specific options supported.</para></listitem>
<listitem><para>Configures support for notifications from the container's init process. This is equivalent to
the <option>--notify-ready=</option> command line switch, and takes the same paramaters. See
<citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
about the specific options supported.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>SystemCallFilter=</varname></term>
<listitem><para>Configures the system call filter applied to containers. This is equivalent to the
<option>--system-call-filter=</option> command line switch, and takes the same list parameter. See
<citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
details.</para></listitem>
</varlistentry>
</variablelist>
</refsect1>