Allow adding syscalls by group names #18

新增問題

crtxcr · 2021-09-06T22:35:05+02:00

crtxcr 已留言

2021-09-06 22:35:05 +02:00

擁有者

If you add "open", there is a chance you also want to block "openat"...

So make this easy by allow adding system call by group names to the policy.

Also, maybe take some inspiration from pledge().

If you add "open", there is a chance you also want to block "openat"... So make this easy by allow adding system call by group names to the policy. Also, maybe take some inspiration from pledge().

crtxcr 加入了

enhancement

標籤 2021-09-06 22:35:05 +02:00

crtxcr 已留言

2021-09-18 22:55:42 +02:00

作者

擁有者

If there was a kernel update, but no qssb.h update or code is using an outdated verison, new syscalls could have been added that are not in any group yet.

Thus, we may habe to auto blacklist all those that we do not know.

Alternatively, adding syscalls by groups should only be allowed for whitelisting?

If there was a kernel update, but no qssb.h update or code is using an outdated verison, new syscalls could have been added that are not in any group yet. Thus, we may habe to auto blacklist all those that we do not know. Alternatively, adding syscalls by groups should only be allowed for whitelisting?

crtxcr 關閉了這個問題

2021-11-20 19:52:05 +01:00

登入才能加入這對話。