Let AF_UNIX connections through the sandbox
Fixes bug 15003; bugfix on 0.2.6.3-alpha.
This commit is contained in:
parent
7a1a0a4cd7
commit
21ac0cd2af
|
@ -0,0 +1,3 @@
|
||||||
|
o Major bugfixes (linux seccomp2 sandbox):
|
||||||
|
- Allow AF_UNIX hidden services to be used with the seccomp2 sandbox.
|
||||||
|
Fixes bug 15003; bugfix on 0.2.6.3-alpha.
|
|
@ -542,6 +542,11 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
|
||||||
return rc;
|
return rc;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
|
||||||
|
SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX),
|
||||||
|
SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM),
|
||||||
|
SCMP_CMP(2, SCMP_CMP_EQ, 0));
|
||||||
|
|
||||||
rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
|
rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
|
||||||
SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK),
|
SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK),
|
||||||
SCMP_CMP(1, SCMP_CMP_EQ, SOCK_RAW),
|
SCMP_CMP(1, SCMP_CMP_EQ, SOCK_RAW),
|
||||||
|
|
Loading…
Reference in New Issue