diff options
| author | Damien Miller <djm@mindrot.org> | 2014-03-17 04:45:56 +0100 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2014-03-17 04:45:56 +0100 |
| commit | 48abc47e60048461fe9117e108a7e99ea1ac2bb8 (patch) | |
| tree | 83ea12268ed3c5999697b7d9e75bfed93e71c0d8 /sandbox-seccomp-filter.c | |
| parent | 20140314 (diff) | |
| download | openssh-48abc47e60048461fe9117e108a7e99ea1ac2bb8.tar.xz openssh-48abc47e60048461fe9117e108a7e99ea1ac2bb8.zip | |
- (djm) [sandbox-seccomp-filter.c] Soft-fail stat() syscalls. Add XXX to
remind myself to add sandbox violation logging via the log socket.
Diffstat (limited to 'sandbox-seccomp-filter.c')
| -rw-r--r-- | sandbox-seccomp-filter.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c index c0c17c2fc..c2be00696 100644 --- a/sandbox-seccomp-filter.c +++ b/sandbox-seccomp-filter.c @@ -25,6 +25,8 @@ */ /* #define SANDBOX_SECCOMP_FILTER_DEBUG 1 */ +/* XXX it should be possible to do logging via the log socket safely */ + #ifdef SANDBOX_SECCOMP_FILTER_DEBUG /* Use the kernel headers in case of an older toolchain. */ # include <asm/siginfo.h> @@ -89,6 +91,7 @@ static const struct sock_filter preauth_insns[] = { BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)), SC_DENY(open, EACCES), + SC_DENY(stat, EACCES), SC_ALLOW(getpid), SC_ALLOW(gettimeofday), SC_ALLOW(clock_gettime), |