Feature: switch/config option to block secondary architectures

Add a feature for a new (opt-in) command line switch and config file
option to block secondary architectures entirely. Also block changing
Linux execution domain with personality() system call for the primary
architecture.

Closes #1479

1 files changed, 4 insertions, 2 deletions

diff --git a/Makefile.in b/Makefile.in
index af30d860e..442766e27 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -2,7 +2,7 @@ all: apps man filters
 MYLIBS = src/lib
 APPS = src/firejail src/firemon src/firecfg src/libtrace src/libtracelog src/ftee src/faudit src/fnet src/fseccomp src/fcopy src/fldd src/libpostexecseccomp
 MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5
-SECCOMP_FILTERS = seccomp seccomp.i386 seccomp.amd64
+SECCOMP_FILTERS = seccomp seccomp.debug seccomp.i386 seccomp.amd64 seccomp.block_secondary seccomp.mwdx
 
 prefix=@prefix@
 exec_prefix=@exec_prefix@
@@ -45,6 +45,7 @@ ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP)
         src/fseccomp/fseccomp default seccomp.debug allow-debuggers
         src/fseccomp/fseccomp secondary 32 seccomp.i386
         src/fseccomp/fseccomp secondary 64 seccomp.amd64
+        src/fseccomp/fseccomp secondary block seccomp.block_secondary
         src/fseccomp/fseccomp memory-deny-write-execute seccomp.mdwx
 endif
 
@@ -53,7 +54,7 @@ clean:
                 $(MAKE) -C $$dir clean; \
         done
         rm -f $(MANPAGES) $(MANPAGES:%=%.gz) firejail*.rpm
-        rm -f seccomp seccomp.debug seccomp.i386 seccomp.amd64 seccomp.mdwx
+        rm -f $(SECCOMP_FILTERS)
         rm -f test/utils/index.html*
         rm -f test/utils/wget-log
         rm -f test/utils/lstesting
@@ -104,6 +105,7 @@ ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP)
         install -c -m 0644 seccomp.debug $(DESTDIR)/$(libdir)/firejail/.
         install -c -m 0644 seccomp.i386 $(DESTDIR)/$(libdir)/firejail/.
         install -c -m 0644 seccomp.amd64 $(DESTDIR)/$(libdir)/firejail/.
+        install -c -m 0644 seccomp.block_secondary $(DESTDIR)/$(libdir)/firejail/.
         install -c -m 0644 seccomp.mdwx $(DESTDIR)/$(libdir)/firejail/.
 endif
 ifeq ($(HAVE_CONTRIB_INSTALL),yes)