summaryrefslogtreecommitdiff
path: root/catalog
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2016-12-27 15:28:25 +0100
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2017-01-17 22:14:27 -0500
commit469830d1426a91e0897c321fdc8ee428f0a750c1 (patch)
treeb77a2ba472790641c14e440f5732688b645c1dae /catalog
parent802fa07a4ad5b29a798896f1566c5e2f85897767 (diff)
seccomp: rework seccomp code, to improve compat with some archs
This substantially reworks the seccomp code, to ensure better compatibility with some architectures, including i386. So far we relied on libseccomp's internal handling of the multiple syscall ABIs supported on Linux. This is problematic however, as it does not define clear semantics if an ABI is not able to support specific seccomp rules we install. This rework hence changes a couple of things: - We no longer use seccomp_rule_add(), but only seccomp_rule_add_exact(), and fail the installation of a filter if the architecture doesn't support it. - We no longer rely on adding multiple syscall architectures to a single filter, but instead install a separate filter for each syscall architecture supported. This way, we can install a strict filter for x86-64, while permitting a less strict filter for i386. - All high-level filter additions are now moved from execute.c to seccomp-util.c, so that we can test them independently of the service execution logic. - Tests have been added for all types of our seccomp filters. - SystemCallFilters= and SystemCallArchitectures= are now implemented in independent filters and installation logic, as they semantically are very much independent of each other. Fixes: #4575
Diffstat (limited to 'catalog')
0 files changed, 0 insertions, 0 deletions