diff options
author | Topi Miettinen <toiwoton@gmail.com> | 2020-03-14 00:07:06 +0200 |
---|---|---|
committer | Topi Miettinen <topimiettinen@users.noreply.github.com> | 2020-03-28 11:24:25 +0000 |
commit | 88eadbf31fe25dcd7c224a5d92f71c79ccf6c9d3 (patch) | |
tree | 6b4d2a805a2900755bfc857586a10948b3c8395e /Makefile.in | |
parent | Added compatibility with BetterDiscord (#3300) (diff) | |
download | firejail-88eadbf31fe25dcd7c224a5d92f71c79ccf6c9d3.tar.gz firejail-88eadbf31fe25dcd7c224a5d92f71c79ccf6c9d3.tar.zst firejail-88eadbf31fe25dcd7c224a5d92f71c79ccf6c9d3.zip |
seccomp: allow defining separate filters for 32-bit arch
System calls (names and numbers) are not exactly the same for 32 bit
and 64 bit architectures. Let's allow defining separate filters for
32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This
is useful for mixed 64/32 bit application environments like Steam and
Wine.
Implement protocol and mdwx filtering also for 32 bit arch. It's still
better to block secondary archs completely if not needed.
Lists of supported system calls are also updated.
Warn if preload libraries would be needed due to trace, tracelog or
postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic
linker does not understand the 64 bit preload libraries.
Closes #3267.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
Diffstat (limited to 'Makefile.in')
-rw-r--r-- | Makefile.in | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/Makefile.in b/Makefile.in index f7c94aa09..afe8c9972 100644 --- a/Makefile.in +++ b/Makefile.in | |||
@@ -3,7 +3,7 @@ MYLIBS = src/lib | |||
3 | APPS = src/firejail src/firemon src/fsec-print src/fsec-optimize src/firecfg src/fnetfilter src/libtrace src/libtracelog src/ftee \ | 3 | APPS = src/firejail src/firemon src/fsec-print src/fsec-optimize src/firecfg src/fnetfilter src/libtrace src/libtracelog src/ftee \ |
4 | src/faudit src/fnet src/fseccomp src/fbuilder src/fcopy src/fldd src/libpostexecseccomp src/profstats | 4 | src/faudit src/fnet src/fseccomp src/fbuilder src/fcopy src/fldd src/libpostexecseccomp src/profstats |
5 | MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5 firejail-users.5 | 5 | MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5 firejail-users.5 |
6 | SECCOMP_FILTERS = seccomp seccomp.debug seccomp.32 seccomp.block_secondary seccomp.mdwx | 6 | SECCOMP_FILTERS = seccomp seccomp.debug seccomp.32 seccomp.block_secondary seccomp.mdwx seccomp.mdwx.32 |
7 | 7 | ||
8 | prefix=@prefix@ | 8 | prefix=@prefix@ |
9 | exec_prefix=@exec_prefix@ | 9 | exec_prefix=@exec_prefix@ |
@@ -48,6 +48,7 @@ ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP) | |||
48 | src/fsec-optimize/fsec-optimize seccomp.32 | 48 | src/fsec-optimize/fsec-optimize seccomp.32 |
49 | src/fseccomp/fseccomp secondary block seccomp.block_secondary | 49 | src/fseccomp/fseccomp secondary block seccomp.block_secondary |
50 | src/fseccomp/fseccomp memory-deny-write-execute seccomp.mdwx | 50 | src/fseccomp/fseccomp memory-deny-write-execute seccomp.mdwx |
51 | src/fseccomp/fseccomp memory-deny-write-execute.32 seccomp.mdwx.32 | ||
51 | endif | 52 | endif |
52 | 53 | ||
53 | clean: | 54 | clean: |
@@ -109,6 +110,7 @@ ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP) | |||
109 | install -c -m 0644 seccomp.32 $(DESTDIR)/$(libdir)/firejail/. | 110 | install -c -m 0644 seccomp.32 $(DESTDIR)/$(libdir)/firejail/. |
110 | install -c -m 0644 seccomp.block_secondary $(DESTDIR)/$(libdir)/firejail/. | 111 | install -c -m 0644 seccomp.block_secondary $(DESTDIR)/$(libdir)/firejail/. |
111 | install -c -m 0644 seccomp.mdwx $(DESTDIR)/$(libdir)/firejail/. | 112 | install -c -m 0644 seccomp.mdwx $(DESTDIR)/$(libdir)/firejail/. |
113 | install -c -m 0644 seccomp.mdwx.32 $(DESTDIR)/$(libdir)/firejail/. | ||
112 | endif | 114 | endif |
113 | ifeq ($(HAVE_CONTRIB_INSTALL),yes) | 115 | ifeq ($(HAVE_CONTRIB_INSTALL),yes) |
114 | install -c -m 0755 contrib/fix_private-bin.py $(DESTDIR)/$(libdir)/firejail/. | 116 | install -c -m 0755 contrib/fix_private-bin.py $(DESTDIR)/$(libdir)/firejail/. |