From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 21 May 2015 18:48:39 +0000 (+0200)
Subject: nspawn: prohibit access to the kernel log buffer by default
X-Git-Tag: v220~7
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5ba7a26847846322740c02b9b469f42ea4c3f105;p=thirdparty%2Fsystemd.git

nspawn: prohibit access to the kernel log buffer by default

Unless CAP_SYSLOG is explicitly passed block all access to kmg
---

diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 73f292e284f..500936387ff 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -2932,15 +2932,16 @@ static int setup_seccomp(void) {
                 uint64_t capability;
                 int syscall_num;
         } blacklist[] = {
-                { CAP_SYS_RAWIO,  SCMP_SYS(iopl)},
-                { CAP_SYS_RAWIO,  SCMP_SYS(ioperm)},
-                { CAP_SYS_BOOT,   SCMP_SYS(kexec_load)},
-                { CAP_SYS_ADMIN,  SCMP_SYS(swapon)},
-                { CAP_SYS_ADMIN,  SCMP_SYS(swapoff)},
-                { CAP_SYS_ADMIN,  SCMP_SYS(open_by_handle_at)},
-                { CAP_SYS_MODULE, SCMP_SYS(init_module)},
-                { CAP_SYS_MODULE, SCMP_SYS(finit_module)},
-                { CAP_SYS_MODULE, SCMP_SYS(delete_module)},
+                { CAP_SYS_RAWIO,  SCMP_SYS(iopl)              },
+                { CAP_SYS_RAWIO,  SCMP_SYS(ioperm)            },
+                { CAP_SYS_BOOT,   SCMP_SYS(kexec_load)        },
+                { CAP_SYS_ADMIN,  SCMP_SYS(swapon)            },
+                { CAP_SYS_ADMIN,  SCMP_SYS(swapoff)           },
+                { CAP_SYS_ADMIN,  SCMP_SYS(open_by_handle_at) },
+                { CAP_SYS_MODULE, SCMP_SYS(init_module)       },
+                { CAP_SYS_MODULE, SCMP_SYS(finit_module)      },
+                { CAP_SYS_MODULE, SCMP_SYS(delete_module)     },
+                { CAP_SYSLOG,     SCMP_SYS(syslog)            },
         };
 
         scmp_filter_ctx seccomp;