Merge pull request #10777 from poettering/seccomp-filter-others

list syscalls supported by the local kernel but not in any syscall groups explicitly in "systemd-analyze syscall-filter"
2018-11-16 17:53:50 +01:00
parent 6415fecd4c a9bfb3eff2
commit ca0e33734e
2 changed files with 94 additions and 5 deletions
@@ -308,6 +308,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                "io_cancel\0"
                "io_destroy\0"
                "io_getevents\0"
+                "io_pgetevents\0"
                "io_setup\0"
                "io_submit\0"
        },
@@ -619,7 +620,9 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                "bpf\0"
                "capset\0"
                "chroot\0"
+                "fanotify_init\0"
                "nfsservctl\0"
+                "open_by_handle_at\0"
                "pivot_root\0"
                "quotactl\0"
                "setdomainname\0"