fix restrict-namespaces for Debian 10 and older

1 files changed, 17 insertions, 2 deletions

diff --git a/src/fseccomp/namespaces.c b/src/fseccomp/namespaces.c
index 3df23dcff..8254b54ef 100644
--- a/src/fseccomp/namespaces.c
+++ b/src/fseccomp/namespaces.c
@@ -133,7 +133,8 @@ void deny_ns(const char *fname, const char *list) {
                 RETURN_ALLOW
 #endif
         };
-        write_to_file(fd, filter, sizeof(filter));
+        if (sizeof(filter))
+                write_to_file(fd, filter, sizeof(filter));
 
         filter_end_blacklist(fd);
 
@@ -188,7 +189,21 @@ void deny_ns_32(const char *fname, const char *list) {
                 RETURN_ALLOW
 #endif
         };
-        write_to_file(fd, filter, sizeof(filter));
+
+        // For Debian 10 and older, the size of the filter[] array will be 0.
+        // The following filter will end up being generated:
+        //
+        //     FILE: /run/firejail/mnt/seccomp/seccomp.namespaces.32
+        //       line OP JT JF K
+        //     =================================
+        //       0000: 20 00 00 00000004 ld data.architecture
+        //       0001: 15 01 00 40000003 jeq ARCH_32 0003 (false 0002)
+        //       0002: 06 00 00 7fff0000 ret ALLOW
+        //       0003: 20 00 00 00000000 ld data.syscall-number
+        //       0004: 06 00 00 7fff0000 ret ALLOW
+        //
+        if (sizeof(filter))
+                write_to_file(fd, filter, sizeof(filter));
 
         filter_end_blacklist(fd);