GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 16:57:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

worker-privs: allow new syscalls

Browse Source 
This adds the syscalls used by socket wrapper as observed
in Fedora builders, as well as syscalls observed in different
platforms such as aarch64.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This commit is contained in:
Nikos Mavrogiannopoulos
2020-10-30 22:30:35 +01:00
parent 940e489500
commit 9521918143
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/worker-privs.c
View File

@@ -107,6 +107,14 @@ int disable_system_calls(struct worker_st *ws)
ADD_SYSCALL(getcwd, 0);
ADD_SYSCALL(lstat, 0);
/* Socket wrapper tests use additional syscalls; only enable
* them when socket wrapper is active */
if (getenv("SOCKET_WRAPPER_DIR") != NULL) {
ADD_SYSCALL(stat64, 0);
ADD_SYSCALL(readlink, 0);
ADD_SYSCALL(newfstatat, 0);
}
/* we use quite some system calls here, and in the end
* we don't even know whether a newer libc will change the
* underlying calls to something else. seccomp seems to be useful
@@ -122,7 +130,11 @@ int disable_system_calls(struct worker_st *ws)
ADD_SYSCALL(getrusage, 0);
ADD_SYSCALL(alarm, 0);
ADD_SYSCALL(getpid, 0);
/* memory allocation - both are used by different platforms */
ADD_SYSCALL(brk, 0);
ADD_SYSCALL(mmap, 0);
#ifdef __NR_getrandom
ADD_SYSCALL(getrandom, 0); /* used by gnutls 3.5.x */
#endif
@@ -175,6 +187,8 @@ int disable_system_calls(struct worker_st *ws)
list_for_each(ws->vconfig, vhost, list) {
if (vhost->perm_config.config->xml_config_file) {
ADD_SYSCALL(stat, 0);
ADD_SYSCALL(stat64, 0);
ADD_SYSCALL(newfstatat, 0);
ADD_SYSCALL(open, 0);
ADD_SYSCALL(openat, 0);
break;