From e15216c74d92f6a2906379442ad95a95e4d1ff6d Mon Sep 17 00:00:00 2001 From: Patrick McLean Date: Fri, 10 Jun 2016 10:09:01 -0700 Subject: [PATCH] seccomp: add fcntl and getsockname to seccomp whitelist Recent versions of lldpd make calls to fcntl and getsockname, but they are not in the seccomp whitelist. This patch adds them. Reported by Gentoo users in these bugs: https://bugs.gentoo.org/577576 https://bugs.gentoo.org/564566 --- src/daemon/priv-seccomp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/daemon/priv-seccomp.c b/src/daemon/priv-seccomp.c index bccd378b..4f9e6e60 100644 --- a/src/daemon/priv-seccomp.c +++ b/src/daemon/priv-seccomp.c @@ -148,10 +148,12 @@ priv_seccomp_init(int remote, int child) if ((rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0)) < 0 || /* write needed for */ (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 0)) < 0 || + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(kill), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(bind), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), 0)) < 0 || + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockname), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(uname), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(unlink), 0)) < 0 || (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ioctl), 0)) < 0 || -- 2.39.5