diff options
| author | Lennart Poettering <lennart@poettering.net> | 2017-02-08 16:21:11 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2017-02-08 22:21:27 +0100 |
| commit | ae9d60ce4eb116eefb7c4102074ae1cc13fd3216 (patch) | |
| tree | ba261d6ab1d6128aed129a2e5d597488627b0549 /src/shared/seccomp-util.h | |
| parent | b53ede699cdc5233041a22591f18863fb3fe2672 (diff) | |
seccomp: on s390 the clone() parameters are reversed
Add a bit of code that tries to get the right parameter order in place
for some of the better known architectures, and skips
restrict_namespaces for other archs.
This also bypasses the test on archs where we don't know the right
order.
In this case I didn't bother with testing the case where no filter is
applied, since that is hopefully just an issue for now, as there's
nothing stopping us from supporting more archs, we just need to know
which order is right.
Fixes: #5241
Diffstat (limited to 'src/shared/seccomp-util.h')
| -rw-r--r-- | src/shared/seccomp-util.h | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h index bfbfb5ab3d..61f94de638 100644 --- a/src/shared/seccomp-util.h +++ b/src/shared/seccomp-util.h @@ -91,6 +91,13 @@ int seccomp_memory_deny_write_execute(void); #define SECCOMP_MEMORY_DENY_WRITE_EXECUTE_BROKEN 1 #endif +/* we don't know the right order of the clone() parameters except for these archs, for now */ +#if defined(__x86_64__) || defined(__i386__) || defined(__s390x__) || defined(__s390__) +#define SECCOMP_RESTRICT_NAMESPACES_BROKEN 0 +#else +#define SECCOMP_RESTRICT_NAMESPACES_BROKEN 1 +#endif + extern const uint32_t seccomp_local_archs[]; #define SECCOMP_FOREACH_LOCAL_ARCH(arch) \ |