diff options
| author | Evgeny Vereshchagin <evvers@ya.ru> | 2017-02-07 05:06:54 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-02-07 05:06:54 +0300 |
| commit | d52fbaa58c6b0c928d1d9a2d015edcc63acb0df6 (patch) | |
| tree | a47f04c35e2b3b67bfa153e25bb09d977e74f318 /src/shared/seccomp-util.h | |
| parent | 1fb85797493dde55c9db9725970343a064e9e062 (diff) | |
| parent | 142bd808a1a1a4a7dc4e75b7a9d1bda6c1530dfd (diff) | |
Merge pull request #5225 from poettering/seccomp-socket
make RestrictAddressFamilies= officially a NOP on i386
Diffstat (limited to 'src/shared/seccomp-util.h')
| -rw-r--r-- | src/shared/seccomp-util.h | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h index 4438e87fa6..2563fcd38a 100644 --- a/src/shared/seccomp-util.h +++ b/src/shared/seccomp-util.h @@ -76,6 +76,14 @@ int seccomp_restrict_address_families(Set *address_families, bool whitelist); int seccomp_restrict_realtime(void); int seccomp_memory_deny_write_execute(void); +#if defined(__i386__) || defined(__s390x__) || defined(__s390__) || defined(__powerpc64__) || defined(__powerpc__) || defined (__mips__) +/* On these archs, socket() is implemented via the socketcall() syscall multiplexer, and we can't restrict it hence via + * seccomp */ +#define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 1 +#else +#define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 0 +#endif + extern const uint32_t seccomp_local_archs[]; #define SECCOMP_FOREACH_LOCAL_ARCH(arch) \ |