Add seccomp errno filter support #66
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| @@ -157,6 +161,11 @@ void filter_debug(void) { | |||
| printf(" BLACKLIST %d %s\n", *nr, syscall_find_nr(*nr)); | |||
| i += 2; | |||
| } | |||
| else if (*ptr == 0x15 && *(ptr +14) == 0x5 && *(ptr + 15) == 0) { | |||
There was a problem hiding this comment.
maybe this function could be rewritten using sock_filter struct pointer instead hmm would also take care of the endian stuff
|
For some context, i myself use this to workaround buggy virtualbox shared filesystem that has broken sendfile support, the application will fallback to userland buffered IO if it gets ENOTSUP. |
|
Looks fine, I'll merge it over the weekend. Thanks! |
|
Ok. Please run the tests to make sure it didn't break anything. Any pointers how to run the tests? i installed expect and messed around but did not really work hmm |
|
I go in test directory and run: Take a look at configure script first, it creates a number of bridge devices. To get rid of them I usually reboot my computer after the test. I start the test as "./test.sh | grep TESTING" |
netblue30
pushed a commit
that referenced
this pull request
Sep 26, 2015
Add seccomp errno filter support
kmk3
added a commit
to kmk3/firejail
that referenced
this pull request
Jun 16, 2022
Some shell scripts are not executable, so fix their file modes:
$ git grep -Elz '^#!/bin/(ba)?sh' | xargs -0 -I '{}' \
chmod +x '{}'
Note: I have manually checked that the files changed are indeed intended
to be executable directly and not just sourced, as a script of the
latter kind could also contain a shebang (for example, to help ensure
proper syntax highlighting).
The affected scripts were added on commit 081d1fb ("Add seccomp errno
filter support", 2015-09-23) / PR netblue30#66 and on commit e46dd3e
("git-install", 2017-02-04).
kmk3
added a commit
to kmk3/firejail
that referenced
this pull request
Jun 16, 2022
Some shell scripts are not executable, so fix their file modes:
$ git grep -Elz '^#!/bin/(ba)?sh' | xargs -0 -I '{}' \
chmod +x '{}'
Files changed:
* src/fgit/fgit-uninstall.sh
* src/tools/extract_errnos.sh
Note: I have manually checked that the files above are indeed intended
to be executable directly and not just sourced, as a script of the
latter kind could also contain a shebang (for example, to help ensure
proper syntax highlighting).
Misc: The affected files were added on commit e46dd3e ("git-install",
2017-02-04) and on commit 081d1fb ("Add seccomp errno filter support",
2015-09-23) / PR netblue30#66, respectively.
kmk3
added a commit
to kmk3/firejail
that referenced
this pull request
Jun 16, 2022
Some shell scripts are not executable, so fix their file modes:
$ git grep -Elz '^#!/bin/(ba)?sh' | xargs -0 -I '{}' \
chmod +x '{}'
Files changed:
* src/fgit/fgit-uninstall.sh
* src/tools/extract_errnos.sh
Note: I have manually checked that the files above are indeed intended
to be executable directly and not just sourced, as a script of the
latter kind could also contain a shebang (for example, to help ensure
proper syntax highlighting).
Misc: The affected files were added on commit e46dd3e ("git-install",
2017-02-04) and on commit 081d1fb ("Add seccomp errno filter support",
2015-09-23) / PR netblue30#66, respectively.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No tests yet. Tried to get the existing tests running without much success :(
Would users like to mix errno and black/white -lists? i currently only need errno filter and default allow.
Tried to keep same code style, hope it is ok.