From: Patrick McLean Date: Fri, 10 Jun 2016 17:09:01 +0000 (-0700) Subject: seccomp: add fcntl and getsockname to seccomp whitelist X-Git-Tag: 0.9.4~18^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e15216c74d92f6a2906379442ad95a95e4d1ff6d;p=thirdparty%2Flldpd.git seccomp: add fcntl and getsockname to seccomp whitelist Recent versions of lldpd make calls to fcntl and getsockname, but they are not in the seccomp whitelist. This patch adds them. Reported by Gentoo users in these bugs: https://bugs.gentoo.org/577576 https://bugs.gentoo.org/564566 --- diff --git a/src/daemon/priv-seccomp.c b/src/daemon/priv-seccomp.c index bccd378b..4f9e6e60 100644 --- a/src/daemon/priv-seccomp.c +++ b/src/daemon/priv-seccomp.c @@ -148,10 +148,12 @@ priv_seccomp_init(int remote, int child) if ((rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0)) < 0 || /* write needed for */ (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 0)) < 0 || + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(kill), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(bind), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), 0)) < 0 || + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockname), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(uname), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(unlink), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ioctl), 0)) < 0 ||