WIP pledge/low-level seccomp arg filter interface #22

crtxcr · 2021-11-21T15:29:20+01:00

crtxcr

2021-11-21 15:29:20 +01:00

yorum yaptı

Sahibi

Herhangi bir açıklama sağlanmadı.

crtxcr WIP/argsfilter 89749bd03b hedefinden 371c6a94b6 hedefine zorla gönderildi 2021-11-30 18:33:22 +01:00 Karşılaştır

crtxcr WIP/argsfilter 371c6a94b6 hedefinden ac3e84ed16 hedefine zorla gönderildi 2021-12-01 23:55:57 +01:00 Karşılaştır

crtxcr

2021-12-02 10:17:27 +01:00

yorum yaptı

Yazar

Sahibi

Test for blacklist:

syscall without args
syscall with args
syscall without args

Test for blacklist: - syscall without args - syscall with args - syscall without args

crtxcr başlığı ~~WIP low-level seccomp arg filter interface~~ iken WIP pledge/low-level seccomp arg filter interface olarak 2021-12-05 17:32:21 +01:00 değiştirdi

crtxcr WIP/argsfilter 7bfa7f5961 hedefinden 08a2445c26 hedefine zorla gönderildi 2021-12-19 20:27:13 +01:00 Karşılaştır

crtxcr WIP/argsfilter fa473601d3 hedefinden eca3b3d622 hedefine zorla gönderildi 2021-12-20 16:16:06 +01:00 Karşılaştır

crtxcr WIP/argsfilter eca3b3d622 hedefinden c7991ceefa hedefine zorla gönderildi 2021-12-20 17:30:51 +01:00 Karşılaştır

crtxcr WIP/argsfilter 9a95ad0c6a hedefinden 34b58c5b32 hedefine zorla gönderildi 2021-12-24 16:22:28 +01:00 Karşılaştır

crtxcr WIP/argsfilter 45f5f16bb8 hedefinden d742397b52 hedefine zorla gönderildi 2021-12-26 18:16:07 +01:00 Karşılaştır

crtxcr WIP/argsfilter beeae95fe1 hedefinden 72ee3b3d74 hedefine zorla gönderildi 2021-12-27 00:44:44 +01:00 Karşılaştır

crtxcr WIP/argsfilter 72ee3b3d74 hedefinden a7a9c6962a hedefine zorla gönderildi 2021-12-27 12:00:41 +01:00 Karşılaştır

crtxcr WIP/argsfilter 3e4ae74203 hedefinden ca0f82790c hedefine zorla gönderildi 2021-12-27 12:36:32 +01:00 Karşılaştır

crtxcr 2 işlemeyi 2021-12-27 14:18:15 +01:00 ekledi

Merge get_pledge_argfilter() with get_pledge_argfilter() 0be081c55d

Include linux/capability.h instead of sys/capability.h 631980b775

Some distros put sys/capability.h into libcap-dev or
similiar, which is a bit unforunate, we don't need
libcap-dev or anything like that.

Since we anyway only used the capget()/capset(), we can
just define a simple wrapper and call the syscall directly
and therefore avoid above mentioned issue.

crtxcr 1 işlemeyi 2021-12-27 14:26:47 +01:00 ekledi

Handle new 5.16 syscall: futex_waitv 98c76089de

crtxcr 1 işlemeyi 2021-12-27 17:03:42 +01:00 ekledi

Add landlock runtime detection 6420ca1b40

We cannot assume that landlock is enabled if we can compile it.
Even if it's enabled in the kernel it may still not be loaded.

We fill fallback to chroot/bind-mounts if we can.

If we can't (because path policies have landlock-specific options),
we can't do that either.

Closes: #21

crtxcr

2021-12-27 17:14:56 +01:00

yorum yaptı

Yazar

Sahibi

Merged

crtxcr

2021-12-27 17:14:56 +01:00

değişiklik isteğini kapattı