From 75a75e87f75d5f2a2c1bf315b29b6a7a4b303de6 Mon Sep 17 00:00:00 2001 From: netblue30 Date: Wed, 2 Aug 2017 08:42:25 -0400 Subject: get_mempolicy syscall was temporarily removed from the default seccomp list. It seems to break playing youtube videos on Firefox Nightly - #1414 --- src/fseccomp/seccomp.c | 10 +++++++--- src/fseccomp/seccomp_secondary.c | 8 ++++++-- 2 files changed, 13 insertions(+), 5 deletions(-) (limited to 'src/fseccomp') diff --git a/src/fseccomp/seccomp.c b/src/fseccomp/seccomp.c index 7d2ccbbce..a30a9e00b 100644 --- a/src/fseccomp/seccomp.c +++ b/src/fseccomp/seccomp.c @@ -162,9 +162,13 @@ static void add_default_list(int fd, int allow_debuggers) { #ifdef SYS_mbind filter_add_blacklist(fd, SYS_mbind, 0); #endif -#ifdef SYS_get_mempolicy - filter_add_blacklist(fd, SYS_get_mempolicy, 0); -#endif + +// breaking Firefox nightly when playing youtube videos +// TODO: test again when firefox sandbox is finally released +//#ifdef SYS_get_mempolicy +// filter_add_blacklist(fd, SYS_get_mempolicy, 0); +//#endif + #ifdef SYS_set_mempolicy filter_add_blacklist(fd, SYS_set_mempolicy, 0); #endif diff --git a/src/fseccomp/seccomp_secondary.c b/src/fseccomp/seccomp_secondary.c index 8270b7018..fceb2c3ec 100644 --- a/src/fseccomp/seccomp_secondary.c +++ b/src/fseccomp/seccomp_secondary.c @@ -67,7 +67,9 @@ void seccomp_secondary_64(const char *fname) { BLACKLIST(210), // io_cancel BLACKLIST(216), // remap_file_pages BLACKLIST(237), // mbind - BLACKLIST(239), // get_mempolicy +// breaking Firefox nightly when playing youtube videos +// TODO: test again when firefox sandbox is finally released +// BLACKLIST(239), // get_mempolicy BLACKLIST(238), // set_mempolicy BLACKLIST(256), // migrate_pages BLACKLIST(279), // move_pages @@ -148,7 +150,9 @@ void seccomp_secondary_32(const char *fname) { BLACKLIST(249), // io_cancel BLACKLIST(257), // remap_file_pages BLACKLIST(274), // mbind - BLACKLIST(275), // get_mempolicy +// breaking Firefox nightly when playing youtube videos +// TODO: test again when firefox sandbox is finally released +// BLACKLIST(275), // get_mempolicy BLACKLIST(276), // set_mempolicy BLACKLIST(294), // migrate_pages BLACKLIST(317), // move_pages -- cgit v1.2.3-54-g00ecf