diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/firejail/main.c | 10 | ||||
-rw-r--r-- | src/firejail/seccomp.c | 4 | ||||
-rw-r--r-- | src/fsec-print/main.c | 8 | ||||
-rw-r--r-- | src/profstats/main.c | 12 |
4 files changed, 24 insertions, 10 deletions
diff --git a/src/firejail/main.c b/src/firejail/main.c index 17e5a8140..9bff960cb 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -966,8 +966,15 @@ static void run_builder(int argc, char **argv) { | |||
966 | exit(1); | 966 | exit(1); |
967 | } | 967 | } |
968 | 968 | ||
969 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg, bool native) {} | 969 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg, bool native) { |
970 | (void) fd; | ||
971 | (void) syscall; | ||
972 | (void) arg; | ||
973 | (void) ptrarg; | ||
974 | (void) native; | ||
975 | } | ||
970 | 976 | ||
977 | #ifdef HAVE_SECCOMP | ||
971 | static int check_postexec(const char *list) { | 978 | static int check_postexec(const char *list) { |
972 | char *prelist, *postlist; | 979 | char *prelist, *postlist; |
973 | 980 | ||
@@ -978,6 +985,7 @@ static int check_postexec(const char *list) { | |||
978 | } | 985 | } |
979 | return 0; | 986 | return 0; |
980 | } | 987 | } |
988 | #endif | ||
981 | 989 | ||
982 | //******************************************* | 990 | //******************************************* |
983 | // Main program | 991 | // Main program |
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c index b0a48591e..612ece85d 100644 --- a/src/firejail/seccomp.c +++ b/src/firejail/seccomp.c | |||
@@ -324,14 +324,12 @@ int seccomp_filter_keep(bool native) { | |||
324 | if (arg_debug) | 324 | if (arg_debug) |
325 | printf("Build keep seccomp filter\n"); | 325 | printf("Build keep seccomp filter\n"); |
326 | 326 | ||
327 | const char *command, *filter, *postexec_filter, *list; | 327 | const char *filter, *postexec_filter, *list; |
328 | if (native) { | 328 | if (native) { |
329 | command = "keep"; | ||
330 | filter = RUN_SECCOMP_CFG; | 329 | filter = RUN_SECCOMP_CFG; |
331 | postexec_filter = RUN_SECCOMP_POSTEXEC; | 330 | postexec_filter = RUN_SECCOMP_POSTEXEC; |
332 | list = cfg.seccomp_list_keep; | 331 | list = cfg.seccomp_list_keep; |
333 | } else { | 332 | } else { |
334 | command = "keep32"; | ||
335 | filter = RUN_SECCOMP_32; | 333 | filter = RUN_SECCOMP_32; |
336 | postexec_filter = RUN_SECCOMP_POSTEXEC_32; | 334 | postexec_filter = RUN_SECCOMP_POSTEXEC_32; |
337 | list = cfg.seccomp_list_keep32; | 335 | list = cfg.seccomp_list_keep32; |
diff --git a/src/fsec-print/main.c b/src/fsec-print/main.c index 7bb4fd0cd..8b7c68434 100644 --- a/src/fsec-print/main.c +++ b/src/fsec-print/main.c | |||
@@ -25,7 +25,13 @@ static void usage(void) { | |||
25 | } | 25 | } |
26 | 26 | ||
27 | int arg_quiet = 0; | 27 | int arg_quiet = 0; |
28 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg, bool native) {} | 28 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg, bool native) { |
29 | (void) fd; | ||
30 | (void) syscall; | ||
31 | (void) arg; | ||
32 | (void) ptrarg; | ||
33 | (void) native; | ||
34 | } | ||
29 | 35 | ||
30 | int main(int argc, char **argv) { | 36 | int main(int argc, char **argv) { |
31 | #if 0 | 37 | #if 0 |
diff --git a/src/profstats/main.c b/src/profstats/main.c index ac02c69bc..29acdc7bd 100644 --- a/src/profstats/main.c +++ b/src/profstats/main.c | |||
@@ -68,9 +68,9 @@ static void usage(void) { | |||
68 | printf(" --private-dev - print profiles without private-dev\n"); | 68 | printf(" --private-dev - print profiles without private-dev\n"); |
69 | printf(" --private-tmp - print profiles without private-tmp\n"); | 69 | printf(" --private-tmp - print profiles without private-tmp\n"); |
70 | printf(" --seccomp - print profiles without seccomp\n"); | 70 | printf(" --seccomp - print profiles without seccomp\n"); |
71 | printf(" --memory-deny-write-execute - profile without it\n"); | 71 | printf(" --memory-deny-write-execute - profile without \"memory-deny-write-execute\"\n"); |
72 | printf(" --whitelist-var - print profiles without \"include whitelist-var-common.inc\"\n"); | 72 | printf(" --whitelist-var - print profiles without \"include whitelist-var-common.inc\"\n"); |
73 | printf(" --whitelist-runuser - print profiles without \"include whitelist-runuser-common.inc\"\n"); | 73 | printf(" --whitelist-runuser - print profiles without \"include whitelist-runuser-common.inc\" or \"blacklist ${RUNUSER}\"\n"); |
74 | printf(" --whitelist-usrshare - print profiles without \"include whitelist-usr-share-common.inc\"\n"); | 74 | printf(" --whitelist-usrshare - print profiles without \"include whitelist-usr-share-common.inc\"\n"); |
75 | printf(" --debug\n"); | 75 | printf(" --debug\n"); |
76 | printf("\n"); | 76 | printf("\n"); |
@@ -111,9 +111,10 @@ void process_file(const char *fname) { | |||
111 | cnt_noexec++; | 111 | cnt_noexec++; |
112 | else if (strncmp(ptr, "include whitelist-var-common.inc", 32) == 0) | 112 | else if (strncmp(ptr, "include whitelist-var-common.inc", 32) == 0) |
113 | cnt_whitelistvar++; | 113 | cnt_whitelistvar++; |
114 | else if (strncmp(ptr, "include whitelist-runuser-common.inc", 32) == 0) | 114 | else if (strncmp(ptr, "include whitelist-runuser-common.inc", 36) == 0 || |
115 | strncmp(ptr, "blacklist ${RUNUSER}", 20) == 0) | ||
115 | cnt_whitelistrunuser++; | 116 | cnt_whitelistrunuser++; |
116 | else if (strncmp(ptr, "include whitelist-usr-share-common.inc", 32) == 0) | 117 | else if (strncmp(ptr, "include whitelist-usr-share-common.inc", 38) == 0) |
117 | cnt_whitelistusrshare++; | 118 | cnt_whitelistusrshare++; |
118 | else if (strncmp(ptr, "include disable-common.inc", 26) == 0) | 119 | else if (strncmp(ptr, "include disable-common.inc", 26) == 0) |
119 | cnt_ssh++; | 120 | cnt_ssh++; |
@@ -271,7 +272,8 @@ int main(int argc, char **argv) { | |||
271 | printf(" private-tmp\t\t\t%d\n", cnt_privatetmp); | 272 | printf(" private-tmp\t\t\t%d\n", cnt_privatetmp); |
272 | printf(" whitelist var\t\t%d (include whitelist-var-common.inc)\n", cnt_whitelistvar); | 273 | printf(" whitelist var\t\t%d (include whitelist-var-common.inc)\n", cnt_whitelistvar); |
273 | printf(" whitelist run/user\t\t%d (include whitelist-runuser-common.inc)\n", cnt_whitelistrunuser); | 274 | printf(" whitelist run/user\t\t%d (include whitelist-runuser-common.inc)\n", cnt_whitelistrunuser); |
274 | printf(" whitelist usr/share\t\t%d (include whitelist-usr-share-common.inc)\n", cnt_whitelistusrshare); | 275 | printf(" whitelist usr/share\t\t%d (include whitelist-usr-share-common.inc\n", cnt_whitelistusrshare); |
276 | printf("\t\t\t\t\tor blacklist ${RUNUSER})\n"); | ||
275 | printf(" net none\t\t\t%d\n", cnt_netnone); | 277 | printf(" net none\t\t\t%d\n", cnt_netnone); |
276 | printf("\n"); | 278 | printf("\n"); |
277 | return 0; | 279 | return 0; |