Commit 6e598bbc authored by David Goulet's avatar David Goulet 🤘
Browse files

sched: Add sandbox support for KIST


Signed-off-by: David Goulet's avatarDavid Goulet <dgoulet@torproject.org>
parent a06f2a05
......@@ -653,6 +653,25 @@ sb_socketpair(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
return 0;
}
#ifdef HAVE_KIST_SUPPORT
#include <linux/sockios.h>
static int
sb_ioctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
{
int rc;
(void) filter;
rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ioctl),
SCMP_CMP(1, SCMP_CMP_EQ, SIOCOUTQNSD));
if (rc)
return rc;
return 0;
}
#endif /* HAVE_KIST_SUPPORT */
/**
* Function responsible for setting up the setsockopt syscall for
* the seccomp filter sandbox.
......@@ -760,6 +779,15 @@ sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
return rc;
#endif
#ifdef HAVE_KIST_SUPPORT
#include <netinet/tcp.h>
rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
SCMP_CMP(1, SCMP_CMP_EQ, SOL_TCP),
SCMP_CMP(2, SCMP_CMP_EQ, TCP_INFO));
if (rc)
return rc;
#endif
return 0;
}
......@@ -1060,7 +1088,11 @@ static sandbox_filter_func_t filter_func[] = {
sb_socket,
sb_setsockopt,
sb_getsockopt,
sb_socketpair
sb_socketpair,
#ifdef HAVE_KIST_SUPPORT
sb_ioctl,
#endif
};
const char *
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment