From a8c157ff3081ee963adb0d046015abf9a271fa67 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 25 Oct 2016 15:42:10 +0200
Subject: seccomp: drop execve() from @process list

The system call is already part in @default hence implicitly allowed anyway.
Also, if it is actually blocked then systemd couldn't execute the service in
question anymore, since the application of seccomp is immediately followed by
it.
---
 src/shared/seccomp-util.c | 1 -
 1 file changed, 1 deletion(-)

(limited to 'src/shared/seccomp-util.c')

diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index ad5782fb29..70723e9e4e 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -443,7 +443,6 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 .value =
                 "arch_prctl\0"
                 "clone\0"
-                "execve\0"
                 "execveat\0"
                 "fork\0"
                 "kill\0"
-- 
cgit v1.2.3-54-g00ecf