diff options
| author | Lennart Poettering <lennart@poettering.net> | 2018-04-18 21:19:54 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2018-06-14 17:44:20 +0200 |
| commit | 705268414f6ba6aa96c56d6c39b5ebf74426e847 (patch) | |
| tree | 2269d0bc9a7ffee385bfca234500ce0f6ba22d1d /src/test/test-seccomp.c | |
| parent | f3ab1d39b1a5766f4dbbca5fe652df7e23e3c8fe (diff) | |
| download | systemd-705268414f6ba6aa96c56d6c39b5ebf74426e847.tar.gz | |
seccomp: add new system call filter, suitable as default whitelist for system services
Currently we employ mostly system call blacklisting for our system
services. Let's add a new system call filter group @system-service that
helps turning this around into a whitelist by default.
The new group is very similar to nspawn's default filter list, but in
some ways more restricted (as sethostname() and suchlike shouldn't be
available to most system services just like that) and in others more
relaxed (for example @keyring is blocked in nspawn since it's not
properly virtualized yet in the kernel, but is fine for regular system
services).
Diffstat (limited to 'src/test/test-seccomp.c')
| -rw-r--r-- | src/test/test-seccomp.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c index 33ec680753..d82cb5c1c5 100644 --- a/src/test/test-seccomp.c +++ b/src/test/test-seccomp.c @@ -104,7 +104,8 @@ static void test_filter_sets(void) { if (pid == 0) { /* Child? */ int fd; - if (i == SYSCALL_FILTER_SET_DEFAULT) /* if we look at the default set, whitelist instead of blacklist */ + /* if we look at the default set (or one that includes it), whitelist instead of blacklist */ + if (IN_SET(i, SYSCALL_FILTER_SET_DEFAULT, SYSCALL_FILTER_SET_SYSTEM_SERVICE)) r = seccomp_load_syscall_filter_set(SCMP_ACT_ERRNO(EUCLEAN), syscall_filter_sets + i, SCMP_ACT_ALLOW); else r = seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + i, SCMP_ACT_ERRNO(EUCLEAN)); |