shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-05 23:51:28 +03:00
Code

nspawn: prohibit access to the kernel log buffer by default

Browse Source 
Unless CAP_SYSLOG is explicitly passed block all access to kmg
This commit is contained in:
Lennart Poettering 2015-05-21 20:48:39 +02:00
parent 4c6d20dece
commit 5ba7a26847
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/nspawn/nspawn.c
View File

@ -2932,15 +2932,16 @@ static int setup_seccomp(void) {
uint64_t capability;
int syscall_num;
} blacklist[] = {
{ CAP_SYS_RAWIO, SCMP_SYS(iopl)},
{ CAP_SYS_RAWIO, SCMP_SYS(ioperm)},
{ CAP_SYS_BOOT, SCMP_SYS(kexec_load)},
{ CAP_SYS_ADMIN, SCMP_SYS(swapon)},
{ CAP_SYS_ADMIN, SCMP_SYS(swapoff)},
{ CAP_SYS_ADMIN, SCMP_SYS(open_by_handle_at)},
{ CAP_SYS_MODULE, SCMP_SYS(init_module)},
{ CAP_SYS_MODULE, SCMP_SYS(finit_module)},
{ CAP_SYS_MODULE, SCMP_SYS(delete_module)},
{ CAP_SYS_RAWIO, SCMP_SYS(iopl) },
{ CAP_SYS_RAWIO, SCMP_SYS(ioperm) },
{ CAP_SYS_BOOT, SCMP_SYS(kexec_load) },
{ CAP_SYS_ADMIN, SCMP_SYS(swapon) },
{ CAP_SYS_ADMIN, SCMP_SYS(swapoff) },
{ CAP_SYS_ADMIN, SCMP_SYS(open_by_handle_at) },
{ CAP_SYS_MODULE, SCMP_SYS(init_module) },
{ CAP_SYS_MODULE, SCMP_SYS(finit_module) },
{ CAP_SYS_MODULE, SCMP_SYS(delete_module) },
{ CAP_SYSLOG, SCMP_SYS(syslog) },
};
scmp_filter_ctx seccomp;