diff options
| author | Toni Uhlig <matzeton@googlemail.com> | 2018-06-13 12:37:59 +0200 |
|---|---|---|
| committer | Toni Uhlig <matzeton@googlemail.com> | 2018-06-13 12:37:59 +0200 |
| commit | 4f7d9bf759bc38fc363155643e9b7bb8fcdf0724 (patch) | |
| tree | 2032a3aacd3a8d57fd2d0b85c3a449bbfb74bf69 /src/pseccomp.c | |
| parent | 436983fe412b9e764f6bec422317b8588d175a86 (diff) | |
POTD skeleton #104.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Diffstat (limited to 'src/pseccomp.c')
| -rw-r--r-- | src/pseccomp.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/src/pseccomp.c b/src/pseccomp.c index 07f4152..a08bc11 100644 --- a/src/pseccomp.c +++ b/src/pseccomp.c @@ -15,11 +15,14 @@ static int pseccomp_using_valgrind(void); static const int minimum_disabled_syscalls[] = { + SCMP_SYS(reboot), SCMP_SYS(mount), SCMP_SYS(umount), SCMP_SYS(umount2), SCMP_SYS(ptrace), SCMP_SYS(kexec_load), + SCMP_SYS(kexec_file_load), SCMP_SYS(open_by_handle_at), + SCMP_SYS(create_module), SCMP_SYS(init_module), SCMP_SYS(finit_module), SCMP_SYS(delete_module), @@ -28,10 +31,19 @@ static const int minimum_disabled_syscalls[] = { SCMP_SYS(swapoff), SCMP_SYS(syslog), SCMP_SYS(nice), - SCMP_SYS(kcmp) + SCMP_SYS(kcmp), + SCMP_SYS(unshare), + SCMP_SYS(setns), + SCMP_SYS(pivot_root), + SCMP_SYS(chroot), + SCMP_SYS(fchdir), + SCMP_SYS(capset), + SCMP_SYS(mknod), + SCMP_SYS(mknodat) }; static const int default_allowed_syscalls[] = { + SCMP_SYS(restart_syscall), SCMP_SYS(signalfd), SCMP_SYS(signalfd4), SCMP_SYS(rt_sigreturn), SCMP_SYS(rt_sigprocmask), SCMP_SYS(rt_sigaction), SCMP_SYS(time), SCMP_SYS(nanosleep), @@ -83,6 +95,7 @@ static const int protocol_disabled_syscalls[] = { }; static const int jail_allowed_syscalls[] = { + SCMP_SYS(restart_syscall), SCMP_SYS(signalfd), SCMP_SYS(signalfd4), SCMP_SYS(rt_sigreturn), SCMP_SYS(rt_sigprocmask), SCMP_SYS(rt_sigaction), SCMP_SYS(time), SCMP_SYS(nanosleep), |