diff options
Diffstat (limited to 'src/firejail/seccomp.c')
-rw-r--r-- | src/firejail/seccomp.c | 46 |
1 files changed, 35 insertions, 11 deletions
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c index e47e6c910..808dd4c37 100644 --- a/src/firejail/seccomp.c +++ b/src/firejail/seccomp.c | |||
@@ -208,7 +208,7 @@ int seccomp_filter_drop(bool native) { | |||
208 | // - seccomp | 208 | // - seccomp |
209 | if (cfg.seccomp_list_drop == NULL) { | 209 | if (cfg.seccomp_list_drop == NULL) { |
210 | // default seccomp if error action is not changed | 210 | // default seccomp if error action is not changed |
211 | if (cfg.seccomp_list == NULL && cfg.seccomp_error_action) { | 211 | if (cfg.seccomp_list == NULL && arg_seccomp_error_action == DEFAULT_SECCOMP_ERROR_ACTION) { |
212 | if (arg_seccomp_block_secondary) | 212 | if (arg_seccomp_block_secondary) |
213 | seccomp_filter_block_secondary(); | 213 | seccomp_filter_block_secondary(); |
214 | else { | 214 | else { |
@@ -221,11 +221,29 @@ int seccomp_filter_drop(bool native) { | |||
221 | } | 221 | } |
222 | // default seccomp filter with additional drop list | 222 | // default seccomp filter with additional drop list |
223 | else { // cfg.seccomp_list != NULL | 223 | else { // cfg.seccomp_list != NULL |
224 | if (arg_seccomp_block_secondary) | 224 | int rv; |
225 | |||
226 | if (arg_seccomp_block_secondary) { | ||
227 | if (arg_seccomp_error_action != DEFAULT_SECCOMP_ERROR_ACTION) { | ||
228 | if (arg_debug) | ||
229 | printf("Rebuild secondary block seccomp filter\n"); | ||
230 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4, | ||
231 | PATH_FSECCOMP, "secondary", "block", RUN_SECCOMP_BLOCK_SECONDARY); | ||
232 | if (rv) | ||
233 | exit(rv); | ||
234 | } | ||
225 | seccomp_filter_block_secondary(); | 235 | seccomp_filter_block_secondary(); |
226 | else { | 236 | } else { |
227 | #if defined(__x86_64__) | 237 | #if defined(__x86_64__) |
228 | #if defined(__LP64__) | 238 | #if defined(__LP64__) |
239 | if (arg_seccomp_error_action != DEFAULT_SECCOMP_ERROR_ACTION) { | ||
240 | if (arg_debug) | ||
241 | printf("Rebuild 32 bit seccomp filter\n"); | ||
242 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4, | ||
243 | PATH_FSECCOMP, "secondary", "32", RUN_SECCOMP_32); | ||
244 | if (rv) | ||
245 | exit(rv); | ||
246 | } | ||
229 | seccomp_filter_32(); | 247 | seccomp_filter_32(); |
230 | #endif | 248 | #endif |
231 | #endif | 249 | #endif |
@@ -242,16 +260,22 @@ int seccomp_filter_drop(bool native) { | |||
242 | list = cfg.seccomp_list32; | 260 | list = cfg.seccomp_list32; |
243 | } | 261 | } |
244 | 262 | ||
245 | if (list == NULL) | ||
246 | list = ""; | ||
247 | // build the seccomp filter as a regular user | 263 | // build the seccomp filter as a regular user |
248 | int rv; | 264 | if (list) |
249 | if (arg_allow_debuggers) | 265 | if (arg_allow_debuggers) |
250 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 7, | 266 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 7, |
251 | PATH_FSECCOMP, command, "drop", filter, postexec_filter, list, "allow-debuggers"); | 267 | PATH_FSECCOMP, command, "drop", filter, postexec_filter, list, "allow-debuggers"); |
268 | else | ||
269 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6, | ||
270 | PATH_FSECCOMP, command, "drop", filter, postexec_filter, list); | ||
252 | else | 271 | else |
253 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6, | 272 | if (arg_allow_debuggers) |
254 | PATH_FSECCOMP, command, "drop", filter, postexec_filter, list); | 273 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4, |
274 | PATH_FSECCOMP, command, filter, "allow-debuggers"); | ||
275 | else | ||
276 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3, | ||
277 | PATH_FSECCOMP, command, filter); | ||
278 | |||
255 | if (rv) | 279 | if (rv) |
256 | exit(rv); | 280 | exit(rv); |
257 | 281 | ||