Skip to content

L
lxc
Unverified Commit dfddc8aa by Christian Brauner
Options

seccomp: make do_resolve_add_rule() more strict

Let's error out on syscalls that cannot be resolved or fail to resolve instead of just warning users. Signed-off-by: 's avatarChristian Brauner <christian.brauner@ubuntu.com>
parent 54a051c1
Showing with 2 additions and 4 deletions
src/lxc/seccomp.c
...@@ -500,14 +500,12 @@ bool do_resolve_add_rule(uint32_t arch, char *line, scmp_filter_ctx ctx, ...@@ -500,14 +500,12 @@ bool do_resolve_add_rule(uint32_t arch, char *line, scmp_filter_ctx ctx,
nr = seccomp_syscall_resolve_name(line); nr = seccomp_syscall_resolve_name(line);
if (nr == __NR_SCMP_ERROR) { if (nr == __NR_SCMP_ERROR) {
WARN("Failed to resolve syscall \"%s\"", line); WARN("Failed to resolve syscall \"%s\"", line);
WARN("This syscall will NOT be blacklisted"); return false;
return true;
} }
if (nr < 0) { if (nr < 0) {
WARN("Got negative return value %d for syscall \"%s\"", nr, line); WARN("Got negative return value %d for syscall \"%s\"", nr, line);
WARN("This syscall will NOT be blacklisted"); return false;
return true;
} }
memset(&arg_cmp, 0, sizeof(arg_cmp)); memset(&arg_cmp, 0, sizeof(arg_cmp));
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment