diff options
| author | Aurelien Jarno <aurelien@aurel32.net> | 2020-08-19 22:44:15 +0200 |
|---|---|---|
| committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2020-08-21 10:10:29 +0200 |
| commit | f9252236c8618f7e0476667076b9a939f0e91967 (patch) | |
| tree | ea812f2c9b6f4cb2e5e1c3a4549527a9b55b34d9 /src/nspawn/nspawn-oci.c | |
| parent | 990307c3da61b16c57d958910295b96ea6aa2a5e (diff) | |
| download | systemd-f9252236c8618f7e0476667076b9a939f0e91967.tar.gz | |
seccomp: add support for riscv64
This patch adds seccomp support to the riscv64 architecture. seccomp
support is available in the riscv64 kernel since version 5.5, and it
has just been added to the libseccomp library.
riscv64 uses generic syscalls like aarch64, so I used that architecture
as a reference to find which code has to be modified.
With this patch, the testsuite passes successfully, including the
test-seccomp test. The system boots and works fine with kernel 5.4 (i.e.
without seccomp support) and kernel 5.5 (i.e. with seccomp support). I
have also verified that the "SystemCallFilter=~socket" option prevents a
service to use the ping utility when running on kernel 5.5.
Diffstat (limited to 'src/nspawn/nspawn-oci.c')
| -rw-r--r-- | src/nspawn/nspawn-oci.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/nspawn/nspawn-oci.c b/src/nspawn/nspawn-oci.c index e3ade92371..60a59096fb 100644 --- a/src/nspawn/nspawn-oci.c +++ b/src/nspawn/nspawn-oci.c @@ -1695,6 +1695,9 @@ static int oci_seccomp_arch_from_string(const char *name, uint32_t *ret) { { "SCMP_ARCH_PPC", SCMP_ARCH_PPC }, { "SCMP_ARCH_PPC64", SCMP_ARCH_PPC64 }, { "SCMP_ARCH_PPC64LE", SCMP_ARCH_PPC64LE }, +#ifdef SCMP_ARCH_RISCV64 + { "SCMP_ARCH_RISCV64", SCMP_ARCH_RISCV64 }, +#endif { "SCMP_ARCH_S390", SCMP_ARCH_S390 }, { "SCMP_ARCH_S390X", SCMP_ARCH_S390X }, { "SCMP_ARCH_X32", SCMP_ARCH_X32 }, |