crtxcr/exile.h
1
0
Förgrening 0
Kod Ärenden 14 Pull-förfrågningar 1 Släpp Wiki Aktiviteter

Don't add any seccomp rules by default

Bläddra i källkod 
Cannot be done properly on a pure syscall basis at this point.

A whitelist is almost certainly too restrictive, which means user
has to manually adjust the policy anyway. Then the default is not
of much use. Or too permissive.

A blacklist has to play catchup with new kernel versions. This may
be be improved upon by blocking all unknown (too new) syscall
numbers. However, in light of the fact we drop caps and set no_new_privs,
it's debtable how much we can gain from a blacklist anyway.

So best to leave it to the user. We also need to allow checking args
too in order to make it easier to build policies. Perhaps get
inspiration from pledge() in OpenBSD.
This commit is contained in:
Albert S. 2021-11-20 20:21:51 +01:00
förälder 435bcefa48
incheckning d150c2ecd9
1 ändrade filer med 0 tillägg och 24 borttagningar
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
qssb.h
Visa fil

@ -1583,21 +1583,6 @@ static int enable_no_fs(struct qssb_policy *policy)
return 0;
}
static int qssb_append_predefined_standard_syscall_policy(struct qssb_policy *policy)
{
int appendresult = qssb_append_group_syscall_policy(policy, QSSB_SYSCALL_ALLOW, QSSB_SYSCGROUP_DEFAULT_ALLOW);
if(appendresult != 0)
{
return 1;
}
appendresult = qssb_append_syscall_default_policy(policy, QSSB_SYSCALL_DENY_RET_ERROR);
if(appendresult != 0)
{
return 1;
}
return 0;
}
/* Enables the specified qssb_policy.
*
* This function is not atomic (and can't be). This means some
@ -1745,15 +1730,6 @@ int qssb_enable_policy(struct qssb_policy *policy)
close(landlock_ruleset_fd);
#endif
if(policy->syscall_policies == NULL && policy->disable_syscall_filter == 0)
{
if(qssb_append_predefined_standard_syscall_policy(policy) != 0)
{
QSSB_LOG_ERROR("Failed to add standard predefined syscall policy\n");
return -1;
}
}
if(policy->syscall_policies != NULL)
{
return qssb_enable_syscall_policy(policy);