Allow adding syscalls by group names #18

创建工单

crtxcr · 2021-09-06T22:35:05+02:00

crtxcr 评论于

2021-09-06 22:35:05 +02:00

管理员

If you add "open", there is a chance you also want to block "openat"...

So make this easy by allow adding system call by group names to the policy.

Also, maybe take some inspiration from pledge().

If you add "open", there is a chance you also want to block "openat"... So make this easy by allow adding system call by group names to the policy. Also, maybe take some inspiration from pledge().

crtxcr 于 2021-09-06 22:35:05 +02:00 添加了标签

enhancement

crtxcr 评论于

2021-09-18 22:55:42 +02:00

作者

管理员

If there was a kernel update, but no qssb.h update or code is using an outdated verison, new syscalls could have been added that are not in any group yet.

Thus, we may habe to auto blacklist all those that we do not know.

Alternatively, adding syscalls by groups should only be allowed for whitelisting?

If there was a kernel update, but no qssb.h update or code is using an outdated verison, new syscalls could have been added that are not in any group yet. Thus, we may habe to auto blacklist all those that we do not know. Alternatively, adding syscalls by groups should only be allowed for whitelisting?

crtxcr 于

2021-11-20 19:52:05 +01:00

关闭此工单

登录并参与到对话中。

1 名参与者

通知

到期时间

未设置到期时间。

依赖工单

没有设置依赖项。

参考：crtxcr/exile.h#18