]> git.ipfire.org Git - thirdparty/systemd.git/commit - src/shared/seccomp-util.c
seccomp: move sched_getaffinity() from @system-service to @default 20318/head
authorLennart Poettering <lennart@poettering.net>
Tue, 27 Jul 2021 15:11:09 +0000 (17:11 +0200)
committerLennart Poettering <lennart@poettering.net>
Tue, 27 Jul 2021 15:14:06 +0000 (17:14 +0200)
commit7df660e45682af5c40a236abe1bdc5ddcf3b3533
tree71c9c2a07923f9d4529ce1db26bf2c748e2d7df2
parent67347f37407489a68e12da8f75b78ae1d1168de9
seccomp: move sched_getaffinity() from @system-service to @default

See: https://github.com/systemd/systemd/pull/20191#issuecomment-881982739

In general, we shouldn't blanket move syscalls like this into @default,
given that glibc actually does have fallbacks, afaics. However, as
long as the syscalls are "read-only" and thus benign, I figure it's a
safe thing to do. But we should probably stick to a "if in doubt, don't"
rule, and put these syscalls in @system-service as default, but not into
@default.

I think in the real world @system-service is the sensible group people
should use, and not @default actually.
src/shared/seccomp-util.c