disable x32 ABI

1 files changed, 12 insertions, 0 deletions

diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 7a015963b..0826822bd 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -101,10 +101,22 @@ static void filter_init(void) {
         sfilter_alloc_size = SECSIZE;
         
         // copy the start entries
+#if defined(__x86_64__)
+#define X32_SYSCALL_BIT 0x40000000
+        struct sock_filter filter[] = {
+                VALIDATE_ARCHITECTURE,
+                EXAMINE_SYSCALL,
+                // handle X32 ABI
+                BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, X32_SYSCALL_BIT, 1, 0),
+                BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, 0, 1, 0),
+                RETURN_ERRNO(EPERM)
+        };
+#else
         struct sock_filter filter[] = {
                 VALIDATE_ARCHITECTURE,
                 EXAMINE_SYSCALL
         };
+#endif
         sfilter_index = sizeof(filter) / sizeof(struct sock_filter);    
         memcpy(sfilter, filter, sizeof(filter));
 }