Allow any syscall to be blacklisted (#1447)

Allow any syscall to be blacklisted with aid of LD_PRELOAD library,
libpostexecseccomp.so.

Closes: #1447

1 files changed, 5 insertions, 0 deletions

diff --git a/src/firejail/fs_trace.c b/src/firejail/fs_trace.c
index df76f4fe1..c87d29b5c 100644
--- a/src/firejail/fs_trace.c
+++ b/src/firejail/fs_trace.c
@@ -63,6 +63,11 @@ void fs_trace(void) {
                 if (!arg_quiet)
                         printf("Blacklist violations are logged to syslog\n");
         }
+        if (arg_seccomp_postexec) {
+                fprintf(fp, "%s/libpostexecseccomp.so\n", prefix);
+                if (!arg_quiet)
+                        printf("Post-exec seccomp protector enabled\n");
+        }
 
         SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
         fclose(fp);