zynk/irssi
2
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2026-08-23 18:42:53 +02:00
Code Issues Projects Releases Packages Wiki Activity

Added argument whitelist for clone()

Browse source
This commit is contained in:
namnamc 2015-10-29 23:04:59 -07:00
commit 8137ca430f
1 changed files with 22 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

25
src/core/sandbox.c
View file

@ -22,6 +22,7 @@
#include <linux/futex.h> #include <linux/futex.h>
#include <linux/in.h> #include <linux/in.h>
#include <linux/prctl.h> #include <linux/prctl.h>
#include <linux/sched.h>
#include <seccomp.h> #include <seccomp.h>
#include <signal.h> #include <signal.h>
#include <stdio.h> #include <stdio.h>
@ -162,10 +163,9 @@ void enable_seccomp_sandbox(void)
} }
/* syscalls without argument filtering */ /* syscalls without argument filtering */
const int noarg_whitelist[20] = { const int noarg_whitelist[19] = {
SCMP_SYS(brk), SCMP_SYS(brk),
SCMP_SYS(chdir), SCMP_SYS(chdir),
SCMP_SYS(clone),
SCMP_SYS(close), SCMP_SYS(close),
SCMP_SYS(exit_group), SCMP_SYS(exit_group),
SCMP_SYS(fstat), SCMP_SYS(fstat),
@ -183,7 +183,7 @@ void enable_seccomp_sandbox(void)
SCMP_SYS(umask), SCMP_SYS(umask),
SCMP_SYS(uname) SCMP_SYS(uname)
}; };
for (i = 0; i < 20; i++) { for (i = 0; i < 19; i++) {
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, noarg_whitelist[i], 0); rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, noarg_whitelist[i], 0);
if (rc < 0) if (rc < 0)
goto fail; goto fail;
@ -216,6 +216,25 @@ void enable_seccomp_sandbox(void)
goto fail; goto fail;
#endif #endif
/* clone */
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(clone), 3,
SCMP_A0(SCMP_CMP_EQ, CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD),
SCMP_A1(SCMP_CMP_EQ, 0),
SCMP_A2(SCMP_CMP_EQ, 0));
if (rc < 0)
goto fail;
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(clone), 1,
SCMP_A0(SCMP_CMP_EQ, CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|
CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|
CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID));
if (rc < 0)
goto fail;
rc = seccomp_syscall_priority(ctx, SCMP_SYS(clone), 50);
if (rc < 0)
goto fail;
/* mkdir */ /* mkdir */
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mkdir), 1, rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mkdir), 1,
SCMP_A1(SCMP_CMP_EQ, 0700)); /* src/core/settings.c:828 */ SCMP_A1(SCMP_CMP_EQ, 0700)); /* src/core/settings.c:828 */