sys: specify context for syscall filter

Specify a context to enable different processes using different (more
restrictive) syscall filters.

diff --git a/main.c b/main.c
index e0b5c48ad280b32375cb5e9d50ef92da50692b02..b32cd52905eb0cd5d898087ca2a43221e28917c9 100644 (file)
--- a/main.c
+++ b/main.c
@@ -596,7 +596,7 @@ int main
   CAM_OpenUnixSocket();
 
   if (scfilter_level)
-    SYS_EnableSystemCallFilter(scfilter_level);
+    SYS_EnableSystemCallFilter(scfilter_level, SYS_MAIN_PROCESS);
 
   if (ref_mode == REF_ModeNormal && CNF_GetInitSources() > 0) {
     ref_mode = REF_ModeInitStepSlew;

diff --git a/sys.c b/sys.c
index f3797c4ce7936bc83fa35e1c3d262e7eaf453950..2088c09eda98048032754b218a08dcac8b9797d2 100644 (file)
--- a/sys.c
+++ b/sys.c
@@ -114,10 +114,10 @@ void SYS_DropRoot(uid_t uid, gid_t gid)
 
 /* ================================================== */
 
-void SYS_EnableSystemCallFilter(int level)
+void SYS_EnableSystemCallFilter(int level, SYS_SystemCallContext context)
 {
 #if defined(LINUX) && defined(FEAT_SCFILTER)
-  SYS_Linux_EnableSystemCallFilter(level);
+  SYS_Linux_EnableSystemCallFilter(level, context);
 #else
   LOG_FATAL("system call filter not supported");
 #endif

diff --git a/sys.h b/sys.h
index cb726f27cc68e23744401dea49e0cab4ecdc260c..775e1a3dd511a936aeb43dcd46752b35635c59ed 100644 (file)
--- a/sys.h
+++ b/sys.h
@@ -38,9 +38,13 @@ extern void SYS_Finalise(void);
 /* Drop root privileges to the specified user and group */
 extern void SYS_DropRoot(uid_t uid, gid_t gid);
 
+typedef enum {
+  SYS_MAIN_PROCESS,
+} SYS_SystemCallContext;
+
 /* Enable a system call filter to allow only system calls
    which chronyd normally needs after initialization */
-extern void SYS_EnableSystemCallFilter(int level);
+extern void SYS_EnableSystemCallFilter(int level, SYS_SystemCallContext context);
 
 extern void SYS_SetScheduler(int SchedPriority);
 extern void SYS_LockMemory(void);

diff --git a/sys_linux.c b/sys_linux.c
index d2dc908a72232391c080a957011a39bfaa9f164b..1babfd1734327b0d4e137acd94486b4a193a31b3 100644 (file)
--- a/sys_linux.c
+++ b/sys_linux.c
@@ -474,7 +474,7 @@ void check_seccomp_applicability(void)
 /* ================================================== */
 
 void
-SYS_Linux_EnableSystemCallFilter(int level)
+SYS_Linux_EnableSystemCallFilter(int level, SYS_SystemCallContext context)
 {
   const int syscalls[] = {
     /* Clock */

diff --git a/sys_linux.h b/sys_linux.h
index 551a18649c70075936a708d71a29223712f7a357..799049d56dabb3c11d7ec307f198313169ead6d5 100644 (file)
--- a/sys_linux.h
+++ b/sys_linux.h
@@ -27,13 +27,15 @@
 #ifndef GOT_SYS_LINUX_H
 #define GOT_SYS_LINUX_H
 
+#include "sys.h"
+
 extern void SYS_Linux_Initialise(void);
 
 extern void SYS_Linux_Finalise(void);
 
 extern void SYS_Linux_DropRoot(uid_t uid, gid_t gid, int clock_control);
 
-extern void SYS_Linux_EnableSystemCallFilter(int level);
+extern void SYS_Linux_EnableSystemCallFilter(int level, SYS_SystemCallContext context);
 
 extern int SYS_Linux_CheckKernelVersion(int req_major, int req_minor);