57 lines
1.3 KiB
Diff
57 lines
1.3 KiB
Diff
From b05f904dc5df267f90c6489817a379cb7f7f62ee Mon Sep 17 00:00:00 2001
|
|
From: Mike Gilbert <floppym@gentoo.org>
|
|
Date: Thu, 19 Oct 2023 13:58:20 -0400
|
|
Subject: [PATCH] seccomp: allow syscalls used by Gentoo's LD_PRELOAD sandbox
|
|
|
|
Bug: https://bugs.gentoo.org/728978
|
|
Bug: https://bugs.gentoo.org/889046
|
|
Bug: https://bugs.gentoo.org/915890
|
|
---
|
|
src/seccomp.c | 20 ++++++++++++++++++++
|
|
1 file changed, 20 insertions(+)
|
|
|
|
diff --git a/src/seccomp.c b/src/seccomp.c
|
|
index 87d4c49e..f1804660 100644
|
|
--- a/src/seccomp.c
|
|
+++ b/src/seccomp.c
|
|
@@ -174,6 +174,9 @@ enable_sandbox_full(void)
|
|
ALLOW_RULE(exit_group);
|
|
#ifdef __NR_faccessat
|
|
ALLOW_RULE(faccessat);
|
|
+#endif
|
|
+#ifdef __NR_faccessat2
|
|
+ ALLOW_RULE(faccessat2);
|
|
#endif
|
|
ALLOW_RULE(fcntl);
|
|
ALLOW_RULE(fcntl64);
|
|
@@ -185,9 +188,26 @@ enable_sandbox_full(void)
|
|
ALLOW_RULE(fstatat64);
|
|
#endif
|
|
ALLOW_RULE(futex);
|
|
+ ALLOW_RULE(getcwd);
|
|
ALLOW_RULE(getdents);
|
|
#ifdef __NR_getdents64
|
|
ALLOW_RULE(getdents64);
|
|
+#endif
|
|
+ ALLOW_RULE(getegid);
|
|
+#ifdef __NR_getegid32
|
|
+ ALLOW_RULE(getegid32);
|
|
+#endif
|
|
+ ALLOW_RULE(geteuid);
|
|
+#ifdef __NR_geteuid32
|
|
+ ALLOW_RULE(geteuid32);
|
|
+#endif
|
|
+ ALLOW_RULE(getgid);
|
|
+#ifdef __NR_getgid32
|
|
+ ALLOW_RULE(getgid32);
|
|
+#endif
|
|
+ ALLOW_RULE(getuid);
|
|
+#ifdef __NR_getuid32
|
|
+ ALLOW_RULE(getuid32);
|
|
#endif
|
|
#ifdef FIONREAD
|
|
// called in src/compress.c under sread
|
|
--
|
|
2.42.0
|
|
|