aboutsummaryrefslogtreecommitdiffstats
path: root/src/fseccomp
Commit message (Collapse)AuthorAge
* makefiles: make all, clean and distclean PHONYLibravatar Kelvin M. Klann2021-03-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid a stat() call for each affected target and also potentially speed up parallel builds. From the GNU make manual[1]: > Phony targets are also useful in conjunction with recursive > invocations of make (see Recursive Use of make). In this situation > the makefile will often contain a variable which lists a number of > sub-directories to be built. [...] > The implicit rule search (see Implicit Rules) is skipped for .PHONY > targets. This is why declaring a target as .PHONY is good for > performance, even if you are not worried about the actual file > existing. Commands used to search, replace and cleanup: $ find -type f -name '*Makefile.in' -exec sed -i.bak \ -e 's/^all:/.PHONY: all\nall:/' \ -e 's/^clean:/.PHONY: clean\nclean:/' \ -e 's/^distclean:/.PHONY: distclean\ndistclean:/' '{}' + $ find -type f -name '*Makefile.in.bak' -exec rm '{}' + [1]: https://www.gnu.org/software/make/manual/html_node/Phony-Targets.html
* copyright updateLibravatar startx20172021-02-15
|
* Seccomp error action fixesLibravatar Topi Miettinen2021-02-01
| | | | | | | | | | | | | | fsec-optimize: Optimize BPF with current seccomp error action, not just KILL fseccomp: use correct BPF code for errno action firejail: honor seccomp error action for X32 and secondary filters, rebuild filters if the error action is changed Closes: #3933 Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* non-dumpable pluginsLibravatar smitsohu2021-01-04
| | | | | (hopefully) fixes the issues that led to reverting commits 6abb65d328af61d67361890743190bd4c57f8e3c and 98e42dc6da4e4b1e47ed2aa020012d4dedc1e80e
* added bluetooth to the list of protocols allowed by seccompLibravatar netblue302020-10-28
|
* Merge pull request #3572 from smitsohu/dumpableLibravatar netblue302020-08-22
|\ | | | | hardening: run plugins with dumpable flag cleared
| * cleanupLibravatar smitsohu2020-08-17
| |
| * add dumpable warningsLibravatar smitsohu2020-08-17
| |
* | seccomp: loggingLibravatar Topi Miettinen2020-08-05
|/ | | | | | | Allow `log` as an alternative seccomp error action instead of killing or returning an errno code. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* Fix (fatal-warnings) warning by adding bracesLibravatar Topi Miettinen2020-04-11
|
* Allow changing error action in seccomp filtersLibravatar Topi Miettinen2020-04-06
| | | | | | | | | | | | | | Let user specify the action when seccomp filters trigger: - errno name like EPERM (default) or ENOSYS: return errno and let the process continue. - 'kill': kill the process as previous versions The default action is EPERM, but killing can still be specified with syscall:kill syntax or globally with seccomp-error-action=kill. The action can be also overridden /etc/firejail/firejail.config file. Not killing the process weakens Firejail slightly when trying to contain intrusion, but it may also allow tighter filters if the only alternative is to allow a system call.
* seccomp: allow defining separate filters for 32-bit archLibravatar Topi Miettinen2020-03-28
| | | | | | | | | | | | | | | | | | | | | System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Implement protocol and mdwx filtering also for 32 bit arch. It's still better to block secondary archs completely if not needed. Lists of supported system calls are also updated. Warn if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes #3267. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* move copyright to 2020 (part 2) (#3181)Libravatar glitsj162020-01-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020
* cleanup after scan-buildLibravatar netblue302019-10-31
|
* Revert changes in #2928 to seccomp group @defaultLibravatar Topi Miettinen2019-09-04
| | | | | Reconstruct @default by not relying on the changed system call groups @privileged and @resources.
* Merge pull request #2928 from topimiettinen/seccomp-more-groupsLibravatar netblue302019-08-29
|\ | | | | Add further seccomp groups
| * Add further seccomp groupsLibravatar Topi Miettinen2019-08-28
| | | | | | | | Get further seccomp group definitions from systemd.
* | Allow exceptions to seccomp listsLibravatar Topi Miettinen2019-08-25
|/ | | | | | | Prefix ! can be used to make exceptions to system call blacklists and whitelists used by seccomp, seccomp.drop and seccomp.keep. Closes #1366
* mdwx: block memfd_createLibravatar Topi Miettinen2019-03-05
| | | | | Some profiles may need adjusting if app uses memfd_create(2) and memory-deny-write-execute was enabled.
* move copyright statement to 2019Libravatar smitsohu2019-02-07
|
* fix small memleakLibravatar Reiner Herrmann2019-02-05
|
* removed mincore syscall from default seccomp filterLibravatar netblue302019-01-23
|
* adding mincore syscall to the default seccomp filter and some independent ↵Libravatar netblue302019-01-14
| | | | profiles
* remove seccomp warningLibravatar netblue302018-09-09
|
* Add personality to allow-debuggers (see #2021)Libravatar ಚಿರಾಗ್ ನಟರಾಜ್2018-07-09
|
* reverted commit 5a3eefa6e70e824f545add9169202f788a9ce14d, issue #1948Libravatar netblue302018-05-20
|
* tentative fix for issue #1948Libravatar netblue302018-05-19
|
* remove 64bit seccomp filter from 32bit architecturesLibravatar netblue302018-05-06
|
* consolidate makefilesLibravatar netblue302018-03-31
|
* support Spectre mitigation patch for gcc compilerLibravatar netblue302018-03-23
|
* move copyright statement to 2018Libravatar startx20172018-01-14
|
* replacing seccomp printing with a seccomp disassemblerLibravatar netblue302017-12-28
|
* strip trailing whitespaceLibravatar Fred-Barclay2017-11-19
|
* seccomp mdwx: block pkey_mprotect like mprotectLibravatar Topi Miettinen2017-11-11
|
* Improve seccomp architecture supportLibravatar Topi Miettinen2017-09-10
|
* "module" is already included in "privileged"Libravatar smitsohu2017-09-04
|
* Improve seccomp support for non-x86 architecturesLibravatar Topi Miettinen2017-09-02
|
* Workaround for build problems, but correct problem this timeLibravatar Topi Miettinen2017-09-02
|
* Workaround for build problems on arm64, s390x and sparc64Libravatar Topi Miettinen2017-09-01
|
* Improve cross-platform buildLibravatar Topi Miettinen2017-08-30
|
* fix seccomp secondary filter printing on i386 platformLibravatar netblue302017-08-30
|
* tentative fix for Debian cross-platform buildLibravatar netblue302017-08-30
|
* cleanupLibravatar netblue302017-08-27
|
* fix seccomp.keep for #1490Libravatar netblue302017-08-23
|
* cleanupLibravatar netblue302017-08-23
|
* seccomp: fix errnoLibravatar netblue302017-08-22
|
* Feature: switch/config option to block secondary architecturesLibravatar Topi Miettinen2017-08-19
| | | | | | | | | Add a feature for a new (opt-in) command line switch and config file option to block secondary architectures entirely. Also block changing Linux execution domain with personality() system call for the primary architecture. Closes #1479
* Postpone installation of seccomp filters just before execveLibravatar Topi Miettinen2017-08-19
|
* seccomp testingLibravatar netblue302017-08-18
|
* memory-deny-write-execute testingLibravatar netblue302017-08-18
|
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-02 16:08:16 +0000