diff options
| author | Lennart Poettering <lennart@poettering.net> | 2017-09-11 17:45:21 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2017-09-12 14:06:21 +0200 |
| commit | 960e4569e17abf7c84f07b697d57ac7d0418edfc (patch) | |
| tree | dd8c180c850f0c97fdf6811b6296e79a6d5b7d6b /man/systemd.nspawn.xml | |
| parent | 7609340e2f9d5b5fd46fa767dd41184b273d7e48 (diff) | |
| download | systemd-960e4569e17abf7c84f07b697d57ac7d0418edfc.tar.gz | |
nspawn: implement configurable syscall whitelisting/blacklisting
Now that we have ported nspawn's seccomp code to the generic code in
seccomp-util, let's extend it to support whitelisting and blacklisting
of specific additional syscalls.
This uses similar syntax as PID1's support for system call filtering,
but in contrast to that always implements a blacklist (and not a
whitelist), as we prepopulate the filter with a blacklist, and the
unit's system call filter logic does not come with anything
prepopulated.
(Later on we might actually want to invert the logic here, and
whitelist rather than blacklist things, but at this point let's not do
that. In case we switch this over later, the syscall add/remove logic of
this commit should be compatible conceptually.)
Fixes: #5163
Replaces: #5944
Diffstat (limited to 'man/systemd.nspawn.xml')
| -rw-r--r-- | man/systemd.nspawn.xml | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/man/systemd.nspawn.xml b/man/systemd.nspawn.xml index 4f3f052911..58024a071d 100644 --- a/man/systemd.nspawn.xml +++ b/man/systemd.nspawn.xml @@ -274,11 +274,21 @@ <varlistentry> <term><varname>NotifyReady=</varname></term> - <listitem><para>Configures support for notifications from the container's init process. - This is equivalent to use <option>--notify-ready=</option> command line switch, - and takes the same options. See <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> - for details about the specific options supported.</para></listitem> + <listitem><para>Configures support for notifications from the container's init process. This is equivalent to + the <option>--notify-ready=</option> command line switch, and takes the same paramaters. See + <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details + about the specific options supported.</para></listitem> + </varlistentry> + + <varlistentry> + <term><varname>SystemCallFilter=</varname></term> + + <listitem><para>Configures the system call filter applied to containers. This is equivalent to the + <option>--system-call-filter=</option> command line switch, and takes the same list parameter. See + <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for + details.</para></listitem> </varlistentry> + </variablelist> </refsect1> |