Commit Diff

Commit:
4f0e893cd3889acb8e3d40d359610749189adc25
From:
Omar Polo <op@omarpolo.com>
Date:
Message:
tightens seccomp filter: allow only openat(O_RDONLY) be more strict and allow an openat only with the O_RDONLY flag. This is kind of redundant with landlock, but still good to have. Landlock is not yet widely available and won't kill the process upon policy violation; furthermore, landlock can be disabled at boot time. tested on GNU and musl libc on arch and alpine amd64.
Actions:
Patch | Tree
commit - 94c5f99ab038efafa5f5a841d8092a995d9ee03c
commit + 4f0e893cd3889acb8e3d40d359610749189adc25
blob - 8881cbbcf9d87b9ec3418b8f57a66cbdc7a7bb3b
blob + 0ab50d1d64f64481f5190b8589f899c96614579d
--- sandbox.c
+++ sandbox.c
@@ -354,7 +354,7 @@ static struct sock_filter filter[] = {
 	SC_ALLOW(oldfstat),
 #endif
 #ifdef __NR_openat
-	SC_ALLOW(openat),
+	SC_ALLOW_ARG(__NR_openat, 3, O_RDONLY),
 #endif
 #ifdef __NR_prlimit64
 	SC_ALLOW(prlimit64),