|
 |
dfeaf0 |
From 4ae8a24b5ccbee904875a10b7b2301369080a88d Mon Sep 17 00:00:00 2001
|
|
|
dfeaf0 |
From: Christos Zoulas <christos@zoulas.com>
|
|
|
dfeaf0 |
Date: Sun, 6 May 2018 16:36:41 +0000
|
|
|
dfeaf0 |
Subject: [PATCH] add more syscalls; newfstatat is used for stat'ing the magic
|
|
|
dfeaf0 |
file, getdents64 is used for getting the magic entries during compilation.
|
|
|
dfeaf0 |
|
|
|
dfeaf0 |
Upstream-commit: aeddbff330fad0edff2ab4b02dbf0863cd593c3c
|
|
|
dfeaf0 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
dfeaf0 |
---
|
|
|
dfeaf0 |
src/seccomp.c | 15 ++++++++-------
|
|
|
dfeaf0 |
1 file changed, 8 insertions(+), 7 deletions(-)
|
|
|
dfeaf0 |
|
|
|
dfeaf0 |
diff --git a/src/seccomp.c b/src/seccomp.c
|
|
|
dfeaf0 |
index 7c8a3144..481a5624 100644
|
|
|
dfeaf0 |
--- a/src/seccomp.c
|
|
|
dfeaf0 |
+++ b/src/seccomp.c
|
|
|
dfeaf0 |
@@ -59,12 +59,7 @@ enable_sandbox_basic(void)
|
|
|
dfeaf0 |
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
|
|
|
dfeaf0 |
return -1;
|
|
|
dfeaf0 |
|
|
|
dfeaf0 |
-#if 0
|
|
|
dfeaf0 |
- // prevent escape via ptrace
|
|
|
dfeaf0 |
- prctl(PR_SET_DUMPABLE, 0);
|
|
|
dfeaf0 |
-#endif
|
|
|
dfeaf0 |
-
|
|
|
dfeaf0 |
- if (prctl (PR_SET_DUMPABLE, 0, 0, 0, 0) == -1)
|
|
|
dfeaf0 |
+ if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) == -1)
|
|
|
dfeaf0 |
return -1;
|
|
|
dfeaf0 |
|
|
|
dfeaf0 |
// initialize the filter
|
|
|
dfeaf0 |
@@ -171,6 +166,9 @@ enable_sandbox_full(void)
|
|
|
dfeaf0 |
ALLOW_RULE(fcntl);
|
|
|
dfeaf0 |
ALLOW_RULE(fstat);
|
|
|
dfeaf0 |
ALLOW_RULE(getdents);
|
|
|
dfeaf0 |
+#ifdef __NR_getdents64
|
|
|
dfeaf0 |
+ ALLOW_RULE(getdents64);
|
|
|
dfeaf0 |
+#endif
|
|
|
dfeaf0 |
ALLOW_RULE(ioctl);
|
|
|
dfeaf0 |
ALLOW_RULE(lseek);
|
|
|
dfeaf0 |
ALLOW_RULE(lstat);
|
|
|
dfeaf0 |
@@ -178,6 +176,9 @@ enable_sandbox_full(void)
|
|
|
dfeaf0 |
ALLOW_RULE(mprotect);
|
|
|
dfeaf0 |
ALLOW_RULE(mremap);
|
|
|
dfeaf0 |
ALLOW_RULE(munmap);
|
|
|
dfeaf0 |
+#ifdef __NR_newfstatat
|
|
|
dfeaf0 |
+ ALLOW_RULE(newfstatat);
|
|
|
dfeaf0 |
+#endif
|
|
|
dfeaf0 |
ALLOW_RULE(open);
|
|
|
dfeaf0 |
ALLOW_RULE(openat);
|
|
|
dfeaf0 |
ALLOW_RULE(pread64);
|
|
|
dfeaf0 |
--
|
|
|
dfeaf0 |
2.17.0
|
|
|
dfeaf0 |
|