From 5cd45c09b7497be252fe3c53d732b2c1c9320875 Mon Sep 17 00:00:00 2001 From: Albert S Date: Thu, 12 Aug 2021 11:40:29 +0200 Subject: [PATCH] bpf: Use SECCOMP_RET_KILL_PROCESS instead SECCOMP_RET_KILL We generally want to kill the process not the thread. --- qssb.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/qssb.h b/qssb.h index fb8fa01..58bf0de 100644 --- a/qssb.h +++ b/qssb.h @@ -677,7 +677,7 @@ static int seccomp_enable(int *syscalls, size_t n, unsigned int per_syscall, uns */ static int seccomp_enable_blacklist(int *syscalls, size_t n) { - return seccomp_enable(syscalls, n, SECCOMP_RET_KILL, SECCOMP_RET_ALLOW); + return seccomp_enable(syscalls, n, SECCOMP_RET_KILL_PROCESS, SECCOMP_RET_ALLOW); } /* @@ -687,7 +687,7 @@ static int seccomp_enable_blacklist(int *syscalls, size_t n) */ static int seccomp_enable_whitelist(int *syscalls, size_t n) { - return seccomp_enable(syscalls, n, SECCOMP_RET_ALLOW, SECCOMP_RET_KILL); + return seccomp_enable(syscalls, n, SECCOMP_RET_ALLOW, SECCOMP_RET_KILL_PROCESS); } #if HAVE_LANDLOCK == 1