Allow exceptions to seccomp lists

Prefix ! can be used to make exceptions to system call blacklists and
whitelists used by seccomp, seccomp.drop and seccomp.keep.

Closes #1366

1 files changed, 40 insertions, 8 deletions

diff --git a/src/fseccomp/seccomp_file.c b/src/fseccomp/seccomp_file.c
index 2e1f317ed..266ef0c55 100644
--- a/src/fseccomp/seccomp_file.c
+++ b/src/fseccomp/seccomp_file.c
@@ -60,26 +60,58 @@ void filter_init(int fd) {
         write_to_file(fd, filter, sizeof(filter));
 }
 
-void filter_add_whitelist(int fd, int syscall, int arg, void *ptrarg) {
-        (void) arg;
-        (void) ptrarg;
-
+static void write_whitelist(int fd, int syscall) {
         struct sock_filter filter[] = {
                 WHITELIST(syscall)
         };
         write_to_file(fd, filter, sizeof(filter));
 }
 
-void filter_add_blacklist(int fd, int syscall, int arg, void *ptrarg) {
-        (void) arg;
-        (void) ptrarg;
-
+static void write_blacklist(int fd, int syscall) {
         struct sock_filter filter[] = {
                 BLACKLIST(syscall)
         };
         write_to_file(fd, filter, sizeof(filter));
 }
 
+void filter_add_whitelist(int fd, int syscall, int arg, void *ptrarg) {
+        (void) arg;
+        (void) ptrarg;
+
+        if (syscall >= 0) {
+                write_whitelist(fd, syscall);
+        }
+}
+
+// handle seccomp list exceptions (seccomp x,y,!z)
+void filter_add_whitelist_for_excluded(int fd, int syscall, int arg, void *ptrarg) {
+        (void) arg;
+        (void) ptrarg;
+
+        if (syscall < 0) {
+                write_whitelist(fd, -syscall);
+        }
+}
+
+void filter_add_blacklist(int fd, int syscall, int arg, void *ptrarg) {
+        (void) arg;
+        (void) ptrarg;
+
+        if (syscall >= 0) {
+                write_blacklist(fd, syscall);
+        }
+}
+
+// handle seccomp list exceptions (seccomp x,y,!z)
+void filter_add_blacklist_for_excluded(int fd, int syscall, int arg, void *ptrarg) {
+        (void) arg;
+        (void) ptrarg;
+
+        if (syscall < 0) {
+                write_blacklist(fd, -syscall);
+        }
+}
+
 void filter_add_errno(int fd, int syscall, int arg, void *ptrarg) {
         (void) ptrarg;
         struct sock_filter filter[] = {