WIP pledge/low-level seccomp arg filter interface #22

crtxcr · 2021-11-21T15:29:20+01:00

crtxcr a commenté

2021-11-21 15:29:20 +01:00

.

Propriétaire

Sans contenu.

crtxcr a forcé WIP/argsfilter de 89749bd03b à 371c6a94b6 2021-11-30 18:33:22 +01:00. Comparer

crtxcr a forcé WIP/argsfilter de 371c6a94b6 à ac3e84ed16 2021-12-01 23:55:57 +01:00. Comparer

crtxcr a commenté

2021-12-02 10:17:27 +01:00

.

Auteur

Propriétaire

Test for blacklist:

syscall without args
syscall with args
syscall without args

Test for blacklist: - syscall without args - syscall with args - syscall without args

crtxcr a remplacé le titre ~~WIP low-level seccomp arg filter interface~~ par WIP pledge/low-level seccomp arg filter interface 2021-12-05 17:32:21 +01:00.

crtxcr a forcé WIP/argsfilter de 7bfa7f5961 à 08a2445c26 2021-12-19 20:27:13 +01:00. Comparer

crtxcr a forcé WIP/argsfilter de fa473601d3 à eca3b3d622 2021-12-20 16:16:06 +01:00. Comparer

crtxcr a forcé WIP/argsfilter de eca3b3d622 à c7991ceefa 2021-12-20 17:30:51 +01:00. Comparer

crtxcr a forcé WIP/argsfilter de 9a95ad0c6a à 34b58c5b32 2021-12-24 16:22:28 +01:00. Comparer

crtxcr a forcé WIP/argsfilter de 45f5f16bb8 à d742397b52 2021-12-26 18:16:07 +01:00. Comparer

crtxcr a forcé WIP/argsfilter de beeae95fe1 à 72ee3b3d74 2021-12-27 00:44:44 +01:00. Comparer

crtxcr a forcé WIP/argsfilter de 72ee3b3d74 à a7a9c6962a 2021-12-27 12:00:41 +01:00. Comparer

crtxcr a forcé WIP/argsfilter de 3e4ae74203 à ca0f82790c 2021-12-27 12:36:32 +01:00. Comparer

crtxcr a ajouté 2 révisions 2021-12-27 14:18:15 +01:00

Merge get_pledge_argfilter() with get_pledge_argfilter() 0be081c55d

Include linux/capability.h instead of sys/capability.h 631980b775

Some distros put sys/capability.h into libcap-dev or
similiar, which is a bit unforunate, we don't need
libcap-dev or anything like that.

Since we anyway only used the capget()/capset(), we can
just define a simple wrapper and call the syscall directly
and therefore avoid above mentioned issue.

crtxcr a ajouté 1 révision 2021-12-27 14:26:47 +01:00

Handle new 5.16 syscall: futex_waitv 98c76089de

crtxcr a ajouté 1 révision 2021-12-27 17:03:42 +01:00

Add landlock runtime detection 6420ca1b40

We cannot assume that landlock is enabled if we can compile it.
Even if it's enabled in the kernel it may still not be loaded.

We fill fallback to chroot/bind-mounts if we can.

If we can't (because path policies have landlock-specific options),
we can't do that either.

Closes: #21

crtxcr a commenté

2021-12-27 17:14:56 +01:00

.

Auteur

Propriétaire

Merged

crtxcr a fermé cette demande d'ajout

2021-12-27 17:14:56 +01:00

.