SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

seccomp: default to something resembling the current personality when locking it

Browse Source 
Let's lock the personality to the currently set one, if nothing is
specifically specified. But do so with a grain of salt, and never
default to any exotic personality here, but only PER_LINUX or
PER_LINUX32.
This commit is contained in:
Lennart Poettering
2017-08-29 15:56:57 +02:00
parent 78e864e5b3
commit e8132d63fe
4 changed files with 66 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/execute.c
+11 -4
View File
@@ -1457,7 +1457,8 @@ static int apply_restrict_namespaces(Unit *u, const ExecContext *c) {
}
static int apply_lock_personality(const Unit* u, const ExecContext *c) {
unsigned long personality = c->personality;
unsigned long personality;
int r;
assert(u);
assert(c);
@@ -1468,9 +1469,15 @@ static int apply_lock_personality(const Unit* u, const ExecContext *c) {
if (skip_seccomp_unavailable(u, "LockPersonality="))
return 0;
/* If personality is not specified, use the default (Linux) */
if (personality == PERSONALITY_INVALID)
personality = PER_LINUX;
personality = c->personality;
/* If personality is not specified, use either PER_LINUX or PER_LINUX32 depending on what is currently set. */
if (personality == PERSONALITY_INVALID) {
r = opinionated_personality(&personality);
if (r < 0)
return r;
}
return seccomp_lock_personality(personality);
}