summaryrefslogtreecommitdiff
path: root/src/core/execute.c
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2016-08-22 19:01:14 +0200
committerDjalal Harouni <tixxdz@opendz.org>2016-09-25 10:18:44 +0200
commit72246c2a654ead7f7ee6e7799161e2e46dc0b84b (patch)
tree2025639d29d32bf6d022300ae5e98fd76e8ca0b8 /src/core/execute.c
parent6c1e2427df86b11076dffefbcdfd031429f5b256 (diff)
core: enforce seccomp for secondary archs too, for all rules
Let's make sure that all our rules apply to all archs the local kernel supports.
Diffstat (limited to 'src/core/execute.c')
-rw-r--r--src/core/execute.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/src/core/execute.c b/src/core/execute.c
index 2026137721..ee734e8445 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1273,6 +1273,10 @@ static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c)
if (!seccomp)
return -ENOMEM;
+ r = seccomp_add_secondary_archs(seccomp);
+ if (r < 0)
+ goto finish;
+
r = seccomp_rule_add(
seccomp,
SCMP_ACT_ERRNO(EPERM),
@@ -1322,6 +1326,10 @@ static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
if (!seccomp)
return -ENOMEM;
+ r = seccomp_add_secondary_archs(seccomp);
+ if (r < 0)
+ goto finish;
+
/* Determine the highest policy constant we want to allow */
for (i = 0; i < ELEMENTSOF(permitted_policies); i++)
if (permitted_policies[i] > max_policy)