From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 29 Apr 2019 09:54:00 +0000 (+0200)
Subject: seccomp: add scmp_act_kill_process() helper that returns SCMP_ACT_KILL_PROCESS if... 
X-Git-Tag: v243-rc1~381^2~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=915fb3243892b07962dfe3ae0a5b6302ba40bf53;p=thirdparty%2Fsystemd.git

seccomp: add scmp_act_kill_process() helper that returns SCMP_ACT_KILL_PROCESS if supported
---

diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 95e46a6aa4a..72920ee7df1 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -1964,3 +1964,18 @@ int seccomp_restrict_suid_sgid(void) {
 
         return 0;
 }
+
+uint32_t scmp_act_kill_process(void) {
+
+        /* Returns SCMP_ACT_KILL_PROCESS if it's supported, and SCMP_ACT_KILL_THREAD otherwise. We never
+         * actually want to use SCMP_ACT_KILL_THREAD as its semantics are nuts (killing arbitrary threads of
+         * a program is just a bad idea), but on old kernels/old libseccomp it is all we have, and at least
+         * for single-threaded apps does the right thing. */
+
+#ifdef SCMP_ACT_KILL_PROCESS
+        if (seccomp_api_get() >= 3)
+                return SCMP_ACT_KILL_PROCESS;
+#endif
+
+        return SCMP_ACT_KILL; /* same as SCMP_ACT_KILL_THREAD */
+}
diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h
index 2566d2d17f2..1729dc1b6ee 100644
--- a/src/shared/seccomp-util.h
+++ b/src/shared/seccomp-util.h
@@ -104,3 +104,5 @@ extern const uint32_t seccomp_local_archs[];
 DEFINE_TRIVIAL_CLEANUP_FUNC(scmp_filter_ctx, seccomp_release);
 
 int parse_syscall_archs(char **l, Set **archs);
+
+uint32_t scmp_act_kill_process(void);