From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 22 Aug 2016 17:01:14 +0000 (+0200)
Subject: core: enforce seccomp for secondary archs too, for all rules
X-Git-Tag: v232~181^2~40
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=72246c2a654ead7f7ee6e7799161e2e46dc0b84b;p=thirdparty%2Fsystemd.git

core: enforce seccomp for secondary archs too, for all rules

Let's make sure that all our rules apply to all archs the local kernel
supports.
---

diff --git a/src/core/execute.c b/src/core/execute.c
index 2026137721f..ee734e8445f 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1273,6 +1273,10 @@ static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c)
         if (!seccomp)
                 return -ENOMEM;
 
+        r = seccomp_add_secondary_archs(seccomp);
+        if (r < 0)
+                goto finish;
+
         r = seccomp_rule_add(
                         seccomp,
                         SCMP_ACT_ERRNO(EPERM),
@@ -1322,6 +1326,10 @@ static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
         if (!seccomp)
                 return -ENOMEM;
 
+        r = seccomp_add_secondary_archs(seccomp);
+        if (r < 0)
+                goto finish;
+
         /* Determine the highest policy constant we want to allow */
         for (i = 0; i < ELEMENTSOF(permitted_policies); i++)
                 if (permitted_policies[i] > max_policy)