zynk/irssi
2
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2026-08-23 02:22:36 +02:00
Code Issues Projects Releases Packages Wiki Activity

Add socketcall support on 32 bit architectures, and fix a typo in irssi.c

Browse source
This commit is contained in:
namnamc 2015-10-29 22:05:32 -07:00
commit c7e49ad1dc
2 changed files with 30 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

29
src/core/sandbox.c
View file

@ -193,6 +193,29 @@ void enable_seccomp_sandbox(void)
goto fail; goto fail;
} }
#ifdef __i386__
/* if we are on a 32 bit architecture, we need to use socketcall */
const int socketcall_calls[7] = {
SYS_SOCKET,
SYS_CONNECT,
SYS_GETPEERNAME,
SYS_GETSOCKOPT,
SYS_SETSOCKOPT,
SYS_SENDTO,
SYS_RECVFROM
};
for (i = 0; i < 7; i++) {
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketcall), 1,
SCMP_A0(SCMP_CMP_EQ, socketcall_calls[i]));
if (rc < 0)
goto fail;
}
rc = seccomp_syscall_priority(ctx, SCMP_SYS(socketcall), 50);
if (rc < 0)
goto fail;
#endif
/* mkdir */ /* mkdir */
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mkdir), 1, rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mkdir), 1,
SCMP_A1(SCMP_CMP_EQ, 0700)); /* src/core/settings.c:828 */ SCMP_A1(SCMP_CMP_EQ, 0700)); /* src/core/settings.c:828 */
@ -203,6 +226,7 @@ void enable_seccomp_sandbox(void)
if (rc < 0) if (rc < 0)
goto fail; goto fail;
#ifndef __i386__
/* setsockopt */ /* setsockopt */
struct setsockopt_struct_t { struct setsockopt_struct_t {
int minsockfd; int minsockfd;
@ -250,6 +274,7 @@ void enable_seccomp_sandbox(void)
rc = seccomp_syscall_priority(ctx, SCMP_SYS(getsockopt), 50); rc = seccomp_syscall_priority(ctx, SCMP_SYS(getsockopt), 50);
if (rc < 0) if (rc < 0)
goto fail; goto fail;
#endif
/* ioctl */ /* ioctl */
const int ioctl_array[3] = { const int ioctl_array[3] = {
@ -412,6 +437,7 @@ void enable_seccomp_sandbox(void)
if (rc < 0) if (rc < 0)
goto fail; goto fail;
#ifndef __i386__
/* socket */ /* socket */
struct socket_struct_t { struct socket_struct_t {
int domain; int domain;
@ -455,6 +481,7 @@ void enable_seccomp_sandbox(void)
rc = seccomp_syscall_priority(ctx, SCMP_SYS(getpeername), 50); rc = seccomp_syscall_priority(ctx, SCMP_SYS(getpeername), 50);
if (rc < 0) if (rc < 0)
goto fail; goto fail;
#endif
/* futex */ /* futex */
struct futex_struct_t { struct futex_struct_t {
@ -578,6 +605,7 @@ void enable_seccomp_sandbox(void)
if (rc < 0) if (rc < 0)
goto fail; goto fail;
#ifndef __i386__
/* sendto */ /* sendto */
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(sendto), 4, rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(sendto), 4,
SCMP_A0(SCMP_CMP_GE, 4), SCMP_A0(SCMP_CMP_GE, 4),
@ -604,6 +632,7 @@ void enable_seccomp_sandbox(void)
rc = seccomp_syscall_priority(ctx, SCMP_SYS(recvfrom), 70); rc = seccomp_syscall_priority(ctx, SCMP_SYS(recvfrom), 70);
if (rc < 0) if (rc < 0)
goto fail; goto fail;
#endif
/* access */ /* access */
const int access_mode_array[3] = { const int access_mode_array[3] = {

2
src/fe-text/irssi.c
View file

@ -79,7 +79,7 @@ void mainwindows_layout_deinit(void);
void create_namespaces(void); void create_namespaces(void);
void drop_privileges(void); void drop_privileges(void);
void enforce_resource_limits(void); void enforce_resource_limits(void);
void enforce_seccomp_sandbox(void); void enable_seccomp_sandbox(void);
#endif #endif
void term_dummy_init(void); void term_dummy_init(void);