summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2016-06-10 17:43:38 +0200
committerLennart Poettering <lennart@poettering.net>2016-06-13 16:25:54 +0200
commit1f9ac68b5bc671f1f8b0a32084810d39394208a6 (patch)
tree265be3fb33a2d24bb17008a866aa2032d7460f88 /src
parent50b52222f2d54a3c4d81e0e5987a0400cbcefb53 (diff)
core: improve seccomp syscall grouping a bit
This adds three new seccomp syscall groups: @keyring for kernel keyring access, @cpu-emulation for CPU emulation features, for exampe vm86() for dosemu and suchlike, and @debug for ptrace() and related calls. Also, the @clock group is updated with more syscalls that alter the system clock. capset() is added to @privileged, and pciconfig_iobase() is added to @raw-io. Finally, @obsolete is a cleaned up. A number of syscalls that never existed on Linux and have no number assigned on any architecture are removed, as they only exist in the man pages and other operating sytems, but not in code at all. create_module() is moved from @module to @obsolete, as it is an obsolete system call. mem_getpolicy() is removed from the @obsolete list, as it is not obsolete, but simply a NUMA API.
Diffstat (limited to 'src')
-rw-r--r--src/shared/seccomp-util.c55
1 files changed, 36 insertions, 19 deletions
diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 30d22d2242..8656d112b8 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -95,7 +95,31 @@ const SystemCallFilterSet syscall_filter_sets[] = {
.set_name = "@clock",
.value =
"adjtimex\0"
+ "clock_adjtime\0"
+ "clock_settime\0"
"settimeofday\0"
+ "stime\0"
+ }, {
+ /* CPU emulation calls */
+ .set_name = "@cpu-emulation",
+ .value =
+ "modify_ldt\0"
+ "subpage_prot\0"
+ "switch_endian\0"
+ "vm86\0"
+ "vm86old\0"
+ }, {
+ /* Debugging/Performance Monitoring/Tracing */
+ .set_name = "@debug",
+ .value =
+ "lookup_dcookie\0"
+ "perf_event_open\0"
+ "process_vm_readv\0"
+ "process_vm_writev\0"
+ "ptrace\0"
+ "rtas\0"
+ "s390_runtime_instr\0"
+ "sys_debug_setcontext\0"
}, {
/* Default list */
.set_name = "@default",
@@ -148,10 +172,16 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"shmdt\0"
"shmget\0"
}, {
+ /* Keyring */
+ .set_name = "@keyring",
+ .value =
+ "add_key\0"
+ "keyctl\0"
+ "request_key\0"
+ }, {
/* Kernel module control */
.set_name = "@module",
.value =
- "create_module\0"
"delete_module\0"
"finit_module\0"
"init_module\0"
@@ -197,40 +227,26 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"_sysctl\0"
"afs_syscall\0"
"break\0"
- "fattach\0"
- "fdetach\0"
+ "create_module\0"
"ftime\0"
"get_kernel_syms\0"
- "get_mempolicy\0"
- "getmsg\0"
"getpmsg\0"
"gtty\0"
- "isastream\0"
"lock\0"
- "madvise1\0"
- "modify_ldt\0"
"mpx\0"
- "pciconfig_iobase\0"
- "perf_event_open\0"
"prof\0"
"profil\0"
- "putmsg\0"
"putpmsg\0"
"query_module\0"
- "rtas\0"
- "s390_runtime_instr\0"
"security\0"
"sgetmask\0"
"ssetmask\0"
"stty\0"
- "subpage_prot\0"
- "switch_endian\0"
- "sys_debug_setcontext\0"
+ "sysfs\0"
"tuxcall\0"
"ulimit\0"
"uselib\0"
- "vm86\0"
- "vm86old\0"
+ "ustat\0"
"vserver\0"
}, {
/* Nice grab-bag of all system calls which need superuser capabilities */
@@ -242,6 +258,7 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"acct\0"
"bdflush\0"
"bpf\0"
+ "capset\0"
"chown32\0"
"chown\0"
"chroot\0"
@@ -268,7 +285,6 @@ const SystemCallFilterSet syscall_filter_sets[] = {
"setreuid\0"
"setuid32\0"
"setuid\0"
- "stime\0"
"swapoff\0"
"swapon\0"
"sysctl\0"
@@ -295,6 +311,7 @@ const SystemCallFilterSet syscall_filter_sets[] = {
.value =
"ioperm\0"
"iopl\0"
+ "pciconfig_iobase\0"
"pciconfig_read\0"
"pciconfig_write\0"
"s390_pci_mmio_read\0"