WIP pledge/low-level seccomp arg filter interface #22

crtxcr · 2021-11-21T15:29:20+01:00

crtxcr 评论于

2021-11-21 15:29:20 +01:00

管理员

没有提供说明。

crtxcr 于 2021-11-30 18:33:22 +01:00 强制推送 WIP/argsfilter，从 89749bd03b，至 371c6a94b6 比较

crtxcr 于 2021-12-01 23:55:57 +01:00 强制推送 WIP/argsfilter，从 371c6a94b6，至 ac3e84ed16 比较

crtxcr 评论于

2021-12-02 10:17:27 +01:00

作者

管理员

Test for blacklist:

syscall without args
syscall with args
syscall without args

Test for blacklist: - syscall without args - syscall with args - syscall without args

crtxcr 于 2021-12-05 17:32:21 +01:00 修改标题 ~~WIP low-level seccomp arg filter interface~~ 为 WIP pledge/low-level seccomp arg filter interface

crtxcr 于 2021-12-19 20:27:13 +01:00 强制推送 WIP/argsfilter，从 7bfa7f5961，至 08a2445c26 比较

crtxcr 于 2021-12-20 16:16:06 +01:00 强制推送 WIP/argsfilter，从 fa473601d3，至 eca3b3d622 比较

crtxcr 于 2021-12-20 17:30:51 +01:00 强制推送 WIP/argsfilter，从 eca3b3d622，至 c7991ceefa 比较

crtxcr 于 2021-12-24 16:22:28 +01:00 强制推送 WIP/argsfilter，从 9a95ad0c6a，至 34b58c5b32 比较

crtxcr 于 2021-12-26 18:16:07 +01:00 强制推送 WIP/argsfilter，从 45f5f16bb8，至 d742397b52 比较

crtxcr 于 2021-12-27 00:44:44 +01:00 强制推送 WIP/argsfilter，从 beeae95fe1，至 72ee3b3d74 比较

crtxcr 于 2021-12-27 12:00:41 +01:00 强制推送 WIP/argsfilter，从 72ee3b3d74，至 a7a9c6962a 比较

crtxcr 于 2021-12-27 12:36:32 +01:00 强制推送 WIP/argsfilter，从 3e4ae74203，至 ca0f82790c 比较

crtxcr 于 2021-12-27 14:18:15 +01:00 推送了 2 个提交

Merge get_pledge_argfilter() with get_pledge_argfilter() 0be081c55d

Include linux/capability.h instead of sys/capability.h 631980b775

Some distros put sys/capability.h into libcap-dev or
similiar, which is a bit unforunate, we don't need
libcap-dev or anything like that.

Since we anyway only used the capget()/capset(), we can
just define a simple wrapper and call the syscall directly
and therefore avoid above mentioned issue.

crtxcr 于 2021-12-27 14:26:47 +01:00 推送了 1 个提交

Handle new 5.16 syscall: futex_waitv 98c76089de

crtxcr 于 2021-12-27 17:03:42 +01:00 推送了 1 个提交

Add landlock runtime detection 6420ca1b40

We cannot assume that landlock is enabled if we can compile it.
Even if it's enabled in the kernel it may still not be loaded.

We fill fallback to chroot/bind-mounts if we can.

If we can't (because path policies have landlock-specific options),
we can't do that either.

Closes: #21

crtxcr 评论于

2021-12-27 17:14:56 +01:00

作者

管理员

Merged

crtxcr 于

2021-12-27 17:14:56 +01:00

关闭此合并请求