]> git.ipfire.org Git - thirdparty/systemd.git/commitdiff
nspawn: realign columns
authorZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Thu, 24 Nov 2022 13:20:56 +0000 (14:20 +0100)
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Tue, 13 Dec 2022 10:36:11 +0000 (11:36 +0100)
Follow-up for b9e7f22c2d80930cad36ae53e66e42a2996dca4a.

src/nspawn/nspawn-seccomp.c

index 27044fadd2a877083d651725a46238ae9333dd34..3d666eeb7966ea7dc74c38c61d77d127708fcb8d 100644 (file)
@@ -33,90 +33,90 @@ static int add_syscall_filters(
                 const char* name;
         } allow_list[] = {
                 /* Let's use set names where we can */
-                { 0,                  "@aio"                   },
-                { 0,                  "@basic-io"              },
-                { 0,                  "@chown"                 },
-                { 0,                  "@default"               },
-                { 0,                  "@file-system"           },
-                { 0,                  "@io-event"              },
-                { 0,                  "@ipc"                   },
-                { 0,                  "@mount"                 },
-                { 0,                  "@network-io"            },
-                { 0,                  "@process"               },
-                { 0,                  "@resources"             },
-                { 0,                  "@setuid"                },
-                { 0,                  "@signal"                },
-                { 0,                  "@sync"                  },
-                { 0,                  "@timer"                 },
-
-                /* The following four are sets we optionally enable, in case the caps have been configured for it */
-                { CAP_SYS_TIME,       "@clock"                 },
-                { CAP_SYS_MODULE,     "@module"                },
-                { CAP_SYS_RAWIO,      "@raw-io"                },
-                { CAP_IPC_LOCK,       "@memlock"               },
+                { 0,                  "@aio"                         },
+                { 0,                  "@basic-io"                    },
+                { 0,                  "@chown"                       },
+                { 0,                  "@default"                     },
+                { 0,                  "@file-system"                 },
+                { 0,                  "@io-event"                    },
+                { 0,                  "@ipc"                         },
+                { 0,                  "@mount"                       },
+                { 0,                  "@network-io"                  },
+                { 0,                  "@process"                     },
+                { 0,                  "@resources"                   },
+                { 0,                  "@setuid"                      },
+                { 0,                  "@signal"                      },
+                { 0,                  "@sync"                        },
+                { 0,                  "@timer"                       },
+
+                /* The following four are sets we optionally enable, n case the caps have been configured for it */
+                { CAP_SYS_TIME,       "@clock"                       },
+                { CAP_SYS_MODULE,     "@module"                      },
+                { CAP_SYS_RAWIO,      "@raw-io"                      },
+                { CAP_IPC_LOCK,       "@memlock"                     },
 
                 /* Plus a good set of additional syscalls which are not part of any of the groups above */
-                { 0,                  "brk"                    },
-                { 0,                  "capget"                 },
-                { 0,                  "capset"                 },
-                { 0,                  "copy_file_range"        },
-                { 0,                  "fadvise64"              },
-                { 0,                  "fadvise64_64"           },
-                { 0,                  "flock"                  },
-                { 0,                  "get_mempolicy"          },
-                { 0,                  "getcpu"                 },
-                { 0,                  "getpriority"            },
-                { 0,                  "getrandom"              },
-                { 0,                  "ioctl"                  },
-                { 0,                  "ioprio_get"             },
-                { 0,                  "kcmp"                   },
-                { 0,                  "madvise"                },
-                { 0,                  "mincore"                },
-                { 0,                  "mprotect"               },
-                { 0,                  "mremap"                 },
-                { 0,                  "name_to_handle_at"      },
-                { 0,                  "oldolduname"            },
-                { 0,                  "olduname"               },
-                { 0,                  "personality"            },
-                { 0,                  "readahead"              },
-                { 0,                  "readdir"                },
-                { 0,                  "remap_file_pages"       },
-                { 0,                  "sched_get_priority_max" },
-                { 0,                  "sched_get_priority_min" },
-                { 0,                  "sched_getaffinity"      },
-                { 0,                  "sched_getattr"          },
-                { 0,                  "sched_getparam"         },
-                { 0,                  "sched_getscheduler"     },
-                { 0,                  "sched_rr_get_interval"  },
+                { 0,                  "brk"                          },
+                { 0,                  "capget"                       },
+                { 0,                  "capset"                       },
+                { 0,                  "copy_file_range"              },
+                { 0,                  "fadvise64"                    },
+                { 0,                  "fadvise64_64"                 },
+                { 0,                  "flock"                        },
+                { 0,                  "get_mempolicy"                },
+                { 0,                  "getcpu"                       },
+                { 0,                  "getpriority"                  },
+                { 0,                  "getrandom"                    },
+                { 0,                  "ioctl"                        },
+                { 0,                  "ioprio_get"                   },
+                { 0,                  "kcmp"                         },
+                { 0,                  "madvise"                      },
+                { 0,                  "mincore"                      },
+                { 0,                  "mprotect"                     },
+                { 0,                  "mremap"                       },
+                { 0,                  "name_to_handle_at"            },
+                { 0,                  "oldolduname"                  },
+                { 0,                  "olduname"                     },
+                { 0,                  "personality"                  },
+                { 0,                  "readahead"                    },
+                { 0,                  "readdir"                      },
+                { 0,                  "remap_file_pages"             },
+                { 0,                  "sched_get_priority_max"       },
+                { 0,                  "sched_get_priority_min"       },
+                { 0,                  "sched_getaffinity"            },
+                { 0,                  "sched_getattr"                },
+                { 0,                  "sched_getparam"               },
+                { 0,                  "sched_getscheduler"           },
+                { 0,                  "sched_rr_get_interval"        },
                 { 0,                  "sched_rr_get_interval_time64" },
-                { 0,                  "sched_yield"            },
-                { 0,                  "seccomp"                },
-                { 0,                  "sendfile"               },
-                { 0,                  "sendfile64"             },
-                { 0,                  "setdomainname"          },
-                { 0,                  "setfsgid"               },
-                { 0,                  "setfsgid32"             },
-                { 0,                  "setfsuid"               },
-                { 0,                  "setfsuid32"             },
-                { 0,                  "sethostname"            },
-                { 0,                  "setpgid"                },
-                { 0,                  "setsid"                 },
-                { 0,                  "splice"                 },
-                { 0,                  "sysinfo"                },
-                { 0,                  "tee"                    },
-                { 0,                  "umask"                  },
-                { 0,                  "uname"                  },
-                { 0,                  "userfaultfd"            },
-                { 0,                  "vmsplice"               },
+                { 0,                  "sched_yield"                  },
+                { 0,                  "seccomp"                      },
+                { 0,                  "sendfile"                     },
+                { 0,                  "sendfile64"                   },
+                { 0,                  "setdomainname"                },
+                { 0,                  "setfsgid"                     },
+                { 0,                  "setfsgid32"                   },
+                { 0,                  "setfsuid"                     },
+                { 0,                  "setfsuid32"                   },
+                { 0,                  "sethostname"                  },
+                { 0,                  "setpgid"                      },
+                { 0,                  "setsid"                       },
+                { 0,                  "splice"                       },
+                { 0,                  "sysinfo"                      },
+                { 0,                  "tee"                          },
+                { 0,                  "umask"                        },
+                { 0,                  "uname"                        },
+                { 0,                  "userfaultfd"                  },
+                { 0,                  "vmsplice"                     },
 
                 /* The following individual syscalls are added depending on specified caps */
-                { CAP_SYS_PACCT,      "acct"                   },
-                { CAP_SYS_PTRACE,     "process_vm_readv"       },
-                { CAP_SYS_PTRACE,     "process_vm_writev"      },
-                { CAP_SYS_PTRACE,     "ptrace"                 },
-                { CAP_SYS_BOOT,       "reboot"                 },
-                { CAP_SYSLOG,         "syslog"                 },
-                { CAP_SYS_TTY_CONFIG, "vhangup"                },
+                { CAP_SYS_PACCT,      "acct"                         },
+                { CAP_SYS_PTRACE,     "process_vm_readv"             },
+                { CAP_SYS_PTRACE,     "process_vm_writev"            },
+                { CAP_SYS_PTRACE,     "ptrace"                       },
+                { CAP_SYS_BOOT,       "reboot"                       },
+                { CAP_SYSLOG,         "syslog"                       },
+                { CAP_SYS_TTY_CONFIG, "vhangup"                      },
 
                 /*
                  * The following syscalls and groups are knowingly excluded: