rdelaage
/
gmid
mirror of https://github.com/omar-polo/gmid.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

sort syscalls in seccomp filter

This commit is contained in:
Omar Polo 2022-02-13 15:32:10 +00:00
parent 67347fb021
commit 94c5f99ab0
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
sandbox.c
View File

@ -308,6 +308,9 @@ static struct sock_filter filter[] = {
#ifdef __NR_fstat64 #ifdef __NR_fstat64
SC_ALLOW(fstat64), SC_ALLOW(fstat64),
#endif #endif
#ifdef __NR_fstatat64
SC_ALLOW(fstatat64),
#endif
#ifdef __NR_getdents64 #ifdef __NR_getdents64
SC_ALLOW(getdents64), SC_ALLOW(getdents64),
#endif #endif
@ -326,6 +329,9 @@ static struct sock_filter filter[] = {
/* allow FIONREAD needed by libevent */ /* allow FIONREAD needed by libevent */
SC_ALLOW_ARG(__NR_ioctl, 1, FIONREAD), SC_ALLOW_ARG(__NR_ioctl, 1, FIONREAD),
#endif #endif
#ifdef __NR__llseek
SC_ALLOW(_llseek),
#endif
#ifdef __NR_lseek #ifdef __NR_lseek
SC_ALLOW(lseek), SC_ALLOW(lseek),
#endif #endif
@ -344,9 +350,6 @@ static struct sock_filter filter[] = {
#ifdef __NR_newfstatat #ifdef __NR_newfstatat
SC_ALLOW(newfstatat), SC_ALLOW(newfstatat),
#endif #endif
#ifdef __NR_fstatat64
SC_ALLOW(fstatat64),
#endif
#ifdef __NR_oldfstat #ifdef __NR_oldfstat
SC_ALLOW(oldfstat), SC_ALLOW(oldfstat),
#endif #endif
@ -374,6 +377,9 @@ static struct sock_filter filter[] = {
#ifdef __NR_sendmsg #ifdef __NR_sendmsg
SC_ALLOW(sendmsg), SC_ALLOW(sendmsg),
#endif #endif
#ifdef __NR_sigreturn
SC_ALLOW(sigreturn),
#endif
#ifdef __NR_statx #ifdef __NR_statx
SC_ALLOW(statx), SC_ALLOW(statx),
#endif #endif
@ -386,12 +392,6 @@ static struct sock_filter filter[] = {
#ifdef __NR_writev #ifdef __NR_writev
SC_ALLOW(writev), SC_ALLOW(writev),
#endif #endif
#ifdef __NR__llseek
SC_ALLOW(_llseek),
#endif
#ifdef __NR_sigreturn
SC_ALLOW(sigreturn),
#endif
/* disallow everything else */ /* disallow everything else */
BPF_STMT(BPF_RET | BPF_K, SC_FAIL), BPF_STMT(BPF_RET | BPF_K, SC_FAIL),