summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorTopi Miettinen <toiwoton@gmail.com>2016-10-26 18:52:53 +0300
committerTopi Miettinen <toiwoton@gmail.com>2016-10-26 18:59:14 +0300
commitd2ffa389b8112282be1633bb4638f6f47e159299 (patch)
tree302dea53e6baa7c26521de3da308ab77b3a5e034 /src
parentd4a48671bc453ead3cff911a0dfcc16ce5538072 (diff)
seccomp: also block shmat(..., SHM_EXEC) for MemoryDenyWriteExecute
shmat(..., SHM_EXEC) can be used to create writable and executable memory, so let's block it when MemoryDenyWriteExecute is set.
Diffstat (limited to 'src')
-rw-r--r--src/core/execute.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/src/core/execute.c b/src/core/execute.c
index 5e7d7c25d7..7b42ac7bdc 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -29,8 +29,10 @@
#include <sys/mman.h>
#include <sys/personality.h>
#include <sys/prctl.h>
+#include <sys/shm.h>
#include <sys/socket.h>
#include <sys/stat.h>
+#include <sys/types.h>
#include <sys/un.h>
#include <unistd.h>
#include <utmpx.h>
@@ -1394,6 +1396,15 @@ static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c)
if (r < 0)
goto finish;
+ r = seccomp_rule_add(
+ seccomp,
+ SCMP_ACT_ERRNO(EPERM),
+ SCMP_SYS(shmat),
+ 1,
+ SCMP_A2(SCMP_CMP_MASKED_EQ, SHM_EXEC, SHM_EXEC));
+ if (r < 0)
+ goto finish;
+
r = seccomp_load(seccomp);
finish: