Attachment 2648 Details for Bug 2361 – proposed patch - stat and shutdown on ix68

proposed patch - stat and shutdown on ix68

file_2361.txt (text/plain), 1.17 KB, created by Jakub Jelen on 2015-06-16 20:00:30 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Jakub Jelen

Created: 2015-06-16 20:00:30 AEST

Size: 1.17 KB

patch

obsolete

>diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
>index 5d508b0..6aff197 100644
>--- a/sandbox-seccomp-filter.c
>+++ b/sandbox-seccomp-filter.c
>@@ -43,6 +43,7 @@
> #include <sys/resource.h>
> #include <sys/prctl.h>
> 
>+#include <linux/net.h>
> #include <linux/audit.h>
> #include <linux/filter.h>
> #include <linux/seccomp.h>
>@@ -94,6 +95,9 @@ static const struct sock_filter preauth_insns[] = {
> #ifdef __NR_open
> 	SC_DENY(open, EACCES), /* not on AArch64 */
> #endif
>+#ifdef __NR_stat
>+	SC_DENY(stat, EACCES),
>+#endif
> #ifdef __NR_fstat
> 	SC_DENY(fstat, EACCES), /* x86_64, Aarch64 */
> #endif
>@@ -154,6 +158,13 @@ static const struct sock_filter preauth_insns[] = {
> #else
> 	SC_ALLOW(sigprocmask),
> #endif
>+#ifdef __NR_socketcall /* enable only shutdown on i386 */
>+	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_socketcall, 0, 3),
>+	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, /* load first argument of syscall */
>+	    offsetof(struct seccomp_data, args[0])),
>+	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_SHUTDOWN, 0, 1),
>+	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
>+#endif /* need to be last check -- it doesn't restore buffer*/
> 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
> };

Actions: View

Attachments on bug 2361: 2561 | 2601 | 2648 | 2649 | 2650 | 2651 | 2652 | 2655