diff options
| author | Lennart Poettering <lennart@poettering.net> | 2016-12-27 14:26:55 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2016-12-27 18:09:37 +0100 |
| commit | bd2ab3f4f67d51c56d6d2813e8ae4802c5a59575 (patch) | |
| tree | 8c1605a40cc69bd58b48d71d3f6fd2601cd6f68f /src/shared/seccomp-util.c | |
| parent | 27e2e3231fc1edbbaa9f73be363900701ab4598d (diff) | |
seccomp: add two new filter sets: @reboot and @swap
These groupe reboot()/kexec() and swapon()/swapoff() respectively
Diffstat (limited to 'src/shared/seccomp-util.c')
| -rw-r--r-- | src/shared/seccomp-util.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index 66b72b2b27..28c2079f30 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -566,6 +566,14 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "s390_pci_mmio_write\0" #endif }, + [SYSCALL_FILTER_SET_REBOOT] = { + .name = "@reboot", + .help = "Reboot and reboot preparation/kexec", + .value = + "kexec\0" + "kexec_file_load\0" + "reboot\0" + }, [SYSCALL_FILTER_SET_RESOURCES] = { /* Alter resource settings */ .name = "@resources", @@ -582,6 +590,13 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "sched_setattr\0" "prlimit64\0" }, + [SYSCALL_FILTER_SET_SWAP] = { + .name = "@swap", + .help = "Enable/disable swap devices", + .value = + "swapoff\0" + "swapon\0" + }, }; const SyscallFilterSet *syscall_filter_set_find(const char *name) { |