1 files changed, 29 insertions, 0 deletions

diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 2200fec01..d709a7951 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -18,6 +18,8 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #include "firejail.h"
+#include "../include/seccomp.h"
+#include "../include/syscall.h"
 #include <dirent.h>
 #include <sys/stat.h>
 extern char *xephyr_screen;
@@ -870,6 +872,33 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
 
+        // seccomp error action
+        if (strncmp(ptr, "seccomp-error-action ", 21) == 0) {
+#ifdef HAVE_SECCOMP
+                if (checkcfg(CFG_SECCOMP)) {
+                        int config_seccomp_error_action = checkcfg(CFG_SECCOMP_ERROR_ACTION);
+                        if (config_seccomp_error_action == -1) {
+                                if (strcmp(ptr + 21, "kill") == 0)
+                                        arg_seccomp_error_action = SECCOMP_RET_KILL;
+                                else {
+                                        arg_seccomp_error_action = errno_find_name(ptr + 21);
+                                        if (arg_seccomp_error_action == -1)
+                                                errExit("seccomp-error-action: unknown errno");
+                                }
+                                cfg.seccomp_error_action = strdup(ptr + 21);
+                                if (!cfg.seccomp_error_action)
+                                        errExit("strdup");
+                        } else {
+                                arg_seccomp_error_action = config_seccomp_error_action;
+                                cfg.seccomp_error_action = config_seccomp_error_action_str;
+                                warning_feature_disabled("seccomp-error-action");
+                        }
+                } else
+                        warning_feature_disabled("seccomp");
+#endif
+                return 0;
+        }
+
         // caps drop list
         if (strncmp(ptr, "caps.drop ", 10) == 0) {
                 arg_caps_drop = 1;