diff options
author | 2020-09-01 13:17:46 -0400 | |
---|---|---|
committer | 2020-09-01 13:17:46 -0400 | |
commit | 52fb58567fa7360cdd0f6631f658f74c7920d0b6 (patch) | |
tree | effedff40e120a72dfcdb9d3e315af0e07e20537 /etc | |
parent | preprocessor for man pages (diff) | |
parent | #3106-1, include @mount in @default insted of all the syscalls (diff) | |
download | firejail-52fb58567fa7360cdd0f6631f658f74c7920d0b6.tar.gz firejail-52fb58567fa7360cdd0f6631f658f74c7920d0b6.tar.zst firejail-52fb58567fa7360cdd0f6631f658f74c7920d0b6.zip |
Merge branch 'master' of https://github.com/netblue30/firejail
Diffstat (limited to 'etc')
-rw-r--r-- | etc/templates/syscalls.txt | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/etc/templates/syscalls.txt b/etc/templates/syscalls.txt index ea3b5a6b0..c454887dd 100644 --- a/etc/templates/syscalls.txt +++ b/etc/templates/syscalls.txt | |||
@@ -33,7 +33,7 @@ Definition of groups | |||
33 | @clock=adjtimex,clock_adjtime,clock_settime,settimeofday,stime | 33 | @clock=adjtimex,clock_adjtime,clock_settime,settimeofday,stime |
34 | @cpu-emulation=modify_ldt,subpage_prot,switch_endian,vm86,vm86old | 34 | @cpu-emulation=modify_ldt,subpage_prot,switch_endian,vm86,vm86old |
35 | @debug=lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext | 35 | @debug=lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext |
36 | @default=@clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@swap,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,kcmp,add_key,request_key,mbind,migrate_pages,move_pages,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,set_mempolicyvmsplice,umount,userfaultfd,acct,bpf,chroot,mount,nfsservctl,pivot_root,setdomainname,sethostname,umount2,vhangup | 36 | @default=@clock,@cpu-emulation,@debug,@module,@mount,@obsolete,@raw-io,@reboot,@swap,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,kcmp,add_key,request_key,mbind,migrate_pages,move_pages,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,set_mempolicyvmsplice,userfaultfd,acct,bpf,nfsservctl,setdomainname,sethostname,vhangup |
37 | @default-nodebuggers=@default,ptrace,personality,process_vm_readv | 37 | @default-nodebuggers=@default,ptrace,personality,process_vm_readv |
38 | @default-keep=execve,prctl | 38 | @default-keep=execve,prctl |
39 | @file-system=access,chdir,chmod,close,creat,faccessat,fallocate,fchdir,fchmod,fchmodat,fcntl,fcntl64,fgetxattr,flistxattr,fremovexattr,fsetxattr,fstat,fstat64,fstatat64,fstatfs,fstatfs64,ftruncate,ftruncate64,futimesat,getcwd,getdents,getdents64,getxattr,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,lgetxattr,link,linkat,listxattr,llistxattr,lremovexattr,lsetxattr,lstat,lstat64,mkdir,mkdirat,mknod,mknodat,mmap,mmap2,munmap,newfstatat,oldfstat,oldlstat,oldstat,open,openat,readlink,readlinkat,removexattr,rename,renameat,renameat2,rmdir,setxattr,stat,stat64,statfs,statfs64,statx,symlink,symlinkat,truncate,truncate64,unlink,unlinkat,utime,utimensat,utimes | 39 | @file-system=access,chdir,chmod,close,creat,faccessat,fallocate,fchdir,fchmod,fchmodat,fcntl,fcntl64,fgetxattr,flistxattr,fremovexattr,fsetxattr,fstat,fstat64,fstatat64,fstatfs,fstatfs64,ftruncate,ftruncate64,futimesat,getcwd,getdents,getdents64,getxattr,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,lgetxattr,link,linkat,listxattr,llistxattr,lremovexattr,lsetxattr,lstat,lstat64,mkdir,mkdirat,mknod,mknodat,mmap,mmap2,munmap,newfstatat,oldfstat,oldlstat,oldstat,open,openat,readlink,readlinkat,removexattr,rename,renameat,renameat2,rmdir,setxattr,stat,stat64,statfs,statfs64,statx,symlink,symlinkat,truncate,truncate64,unlink,unlinkat,utime,utimensat,utimes |
@@ -62,15 +62,14 @@ Inheritance of groups | |||
62 | 62 | ||
63 | +---------------+ | 63 | +---------------+ |
64 | | @default-keep | | 64 | | @default-keep | |
65 | | @mount | | ||
66 | +---------------+ | 65 | +---------------+ |
67 | 66 | ||
68 | +----------------+ +---------+ +--------+ +--------------+ | 67 | +----------------+ +---------+ +--------+ +--------------+ |
69 | | @cpu-emulation | | @clock | | @chown | | @aio | | 68 | | @cpu-emulation | | @clock | | @chown | | @aio | |
70 | | @debug | | @module | +--------+ | @basic-io | | 69 | | @debug | | @module | +--------+ | @basic-io | |
71 | | @obsolete | | @raw-io | : : | @file-system | | 70 | | @obsolete | | @raw-io | : : | @file-system | |
72 | +----------------+ | @reboot | : : | @io-event | | 71 | | @mount | | @reboot | : : | @io-event | |
73 | : | @swap | : : | @ipc | | 72 | +----------------+ | @swap | : : | @ipc | |
74 | : +---------+ : : | @keyring | | 73 | : +---------+ : : | @keyring | |
75 | : : : : : | @memlock | | 74 | : : : : : | @memlock | |
76 | : ..............: : : : | @network-io | | 75 | : ..............: : : : | @network-io | |