Allow adding syscalls by group names #18

Nieuw probleem

crtxcr · 2021-09-06T22:35:05+02:00

crtxcr reageerde

2021-09-06 22:35:05 +02:00

Eigenaar

If you add "open", there is a chance you also want to block "openat"...

So make this easy by allow adding system call by group names to the policy.

Also, maybe take some inspiration from pledge().

If you add "open", there is a chance you also want to block "openat"... So make this easy by allow adding system call by group names to the policy. Also, maybe take some inspiration from pledge().

crtxcr voegde het

enhancement

label 2021-09-06 22:35:05 +02:00 toe

crtxcr reageerde

2021-09-18 22:55:42 +02:00

Eigenaar

If there was a kernel update, but no qssb.h update or code is using an outdated verison, new syscalls could have been added that are not in any group yet.

Thus, we may habe to auto blacklist all those that we do not know.

Alternatively, adding syscalls by groups should only be allowed for whitelisting?

If there was a kernel update, but no qssb.h update or code is using an outdated verison, new syscalls could have been added that are not in any group yet. Thus, we may habe to auto blacklist all those that we do not know. Alternatively, adding syscalls by groups should only be allowed for whitelisting?

crtxcr heeft dit probleem gesloten

2021-11-20 19:52:05 +01:00

Log in om deel te nemen aan deze discussie.

1 deelnemers

Notificaties

Vervaldatum

Geen vervaldatum ingesteld.

Afhankelijkheden

Geen afhankelijkheden ingesteld.

Referentie: crtxcr/exile.h#18