shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-10 01:17:44 +03:00
Code

Request seccomp logging if SYSTEMD_LOG_SECCOMP environment variable is set.

Browse Source
This commit is contained in:
Steve Dodd 2020-08-16 21:57:41 +01:00 committed by Lennart Poettering
parent 3fb01017ee
commit 44aaddad06
2 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/ENVIRONMENT.md
View File

@ -90,6 +90,10 @@ systemctl:
* `$SYSTEMCTL_SKIP_SYSV=1` — if set, do not call out to SysV compatibility hooks.
* `$SYSTEMD_LOG_SECCOMP=1` — if set, system calls blocked by seccomp filtering,
for example in systemd-nspawn, will be logged to the audit log, if the current
kernel version supports this.
systemd-nspawn:
* `$SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=1` — if set, force nspawn into unified

9
src/shared/seccomp-util.c
View File

@ -12,6 +12,7 @@
#include "af-list.h"
#include "alloc-util.h"
#include "env-util.h"
#include "errno-list.h"
#include "macro.h"
#include "nsflags.h"
@ -234,6 +235,14 @@ int seccomp_init_for_arch(scmp_filter_ctx *ret, uint32_t arch, uint32_t default_
if (r < 0)
return r;
#if SCMP_VER_MAJOR >= 3 || (SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR >= 4)
if (getenv_bool("SYSTEMD_LOG_SECCOMP") > 0) {
r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_LOG, 1);
if (r < 0)
log_debug_errno(r, "Failed to enable seccomp event logging: %m");
}
#endif
*ret = TAKE_PTR(seccomp);
return 0;
}