WIP pledge/low-level seccomp arg filter interface #22

crtxcr · 2021-11-21T15:29:20+01:00

crtxcr hat

2021-11-21 15:29:20 +01:00

kommentiert

Besitzer

Keine Beschreibung angegeben.

crtxcr hat 2021-11-30 18:33:22 +01:00 WIP/argsfilter von 89749bd03b zu 371c6a94b6 force-gepusht Vergleichen

crtxcr hat 2021-12-01 23:55:57 +01:00 WIP/argsfilter von 371c6a94b6 zu ac3e84ed16 force-gepusht Vergleichen

crtxcr hat

2021-12-02 10:17:27 +01:00

kommentiert

Autor

Besitzer

Test for blacklist:

syscall without args
syscall with args
syscall without args

Test for blacklist: - syscall without args - syscall with args - syscall without args

crtxcr hat den Titel von ~~WIP low-level seccomp arg filter interface~~ zu WIP pledge/low-level seccomp arg filter interface 2021-12-05 17:32:21 +01:00 geändert

crtxcr hat 2021-12-19 20:27:13 +01:00 WIP/argsfilter von 7bfa7f5961 zu 08a2445c26 force-gepusht Vergleichen

crtxcr hat 2021-12-20 16:16:06 +01:00 WIP/argsfilter von fa473601d3 zu eca3b3d622 force-gepusht Vergleichen

crtxcr hat 2021-12-20 17:30:51 +01:00 WIP/argsfilter von eca3b3d622 zu c7991ceefa force-gepusht Vergleichen

crtxcr hat 2021-12-24 16:22:28 +01:00 WIP/argsfilter von 9a95ad0c6a zu 34b58c5b32 force-gepusht Vergleichen

crtxcr hat 2021-12-26 18:16:07 +01:00 WIP/argsfilter von 45f5f16bb8 zu d742397b52 force-gepusht Vergleichen

crtxcr hat 2021-12-27 00:44:44 +01:00 WIP/argsfilter von beeae95fe1 zu 72ee3b3d74 force-gepusht Vergleichen

crtxcr hat 2021-12-27 12:00:41 +01:00 WIP/argsfilter von 72ee3b3d74 zu a7a9c6962a force-gepusht Vergleichen

crtxcr hat 2021-12-27 12:36:32 +01:00 WIP/argsfilter von 3e4ae74203 zu ca0f82790c force-gepusht Vergleichen

crtxcr hat 2 Commits 2021-12-27 14:18:15 +01:00 hinzugefügt

Merge get_pledge_argfilter() with get_pledge_argfilter() 0be081c55d

Include linux/capability.h instead of sys/capability.h 631980b775

Some distros put sys/capability.h into libcap-dev or
similiar, which is a bit unforunate, we don't need
libcap-dev or anything like that.

Since we anyway only used the capget()/capset(), we can
just define a simple wrapper and call the syscall directly
and therefore avoid above mentioned issue.

crtxcr hat 1 Commit 2021-12-27 14:26:47 +01:00 hinzugefügt

Handle new 5.16 syscall: futex_waitv 98c76089de

crtxcr hat 1 Commit 2021-12-27 17:03:42 +01:00 hinzugefügt

Add landlock runtime detection 6420ca1b40

We cannot assume that landlock is enabled if we can compile it.
Even if it's enabled in the kernel it may still not be loaded.

We fill fallback to chroot/bind-mounts if we can.

If we can't (because path policies have landlock-specific options),
we can't do that either.

Closes: #21

crtxcr hat

2021-12-27 17:14:56 +01:00

kommentiert

Autor

Besitzer

Merged

crtxcr hat diesen Pull-Request

2021-12-27 17:14:56 +01:00

geschlossen