|
21 | 21 | #else
|
22 | 22 | # error "Target architecture is unsupported by seccomp."
|
23 | 23 | #endif
|
24 |
| -static const unsigned int sock_filter_policy_fd_bundle_tile_instr_cnt = 95; |
| 24 | +static const unsigned int sock_filter_policy_fd_bundle_tile_instr_cnt = 96; |
25 | 25 |
|
26 | 26 | static void populate_sock_filter_policy_fd_bundle_tile( ulong out_cnt, struct sock_filter * out, uint logfile_fd, uint keylog_fd, uint etc_hosts_fd, uint etc_resolv_conf ) {
|
27 |
| - FD_TEST( out_cnt >= 95 ); |
28 |
| - struct sock_filter filter[95] = { |
| 27 | + FD_TEST( out_cnt >= 96 ); |
| 28 | + struct sock_filter filter[96] = { |
29 | 29 | /* Check: Jump to RET_KILL_PROCESS if the script's arch != the runtime arch */
|
30 | 30 | BPF_STMT( BPF_LD | BPF_W | BPF_ABS, ( offsetof( struct seccomp_data, arch ) ) ),
|
31 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, ARCH_NR, 0, /* RET_KILL_PROCESS */ 91 ), |
| 31 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, ARCH_NR, 0, /* RET_KILL_PROCESS */ 92 ), |
32 | 32 | /* loading syscall number in accumulator */
|
33 | 33 | BPF_STMT( BPF_LD | BPF_W | BPF_ABS, ( offsetof( struct seccomp_data, nr ) ) ),
|
34 | 34 | /* simply allow read */
|
35 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_read, /* RET_ALLOW */ 90, 0 ), |
| 35 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_read, /* RET_ALLOW */ 91, 0 ), |
36 | 36 | /* allow recvmsg based on expression */
|
37 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_recvmsg, /* check_recvmsg */ 18, 0 ), |
| 37 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_recvmsg, /* check_recvmsg */ 19, 0 ), |
38 | 38 | /* simply allow write */
|
39 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_write, /* RET_ALLOW */ 88, 0 ), |
| 39 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_write, /* RET_ALLOW */ 89, 0 ), |
40 | 40 | /* allow writev based on expression */
|
41 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_writev, /* check_writev */ 20, 0 ), |
| 41 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_writev, /* check_writev */ 21, 0 ), |
42 | 42 | /* allow sendmsg based on expression */
|
43 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_sendmsg, /* check_sendmsg */ 23, 0 ), |
| 43 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_sendmsg, /* check_sendmsg */ 24, 0 ), |
44 | 44 | /* allow sendto based on expression */
|
45 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_sendto, /* check_sendto */ 28, 0 ), |
| 45 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_sendto, /* check_sendto */ 29, 0 ), |
46 | 46 | /* allow fsync based on expression */
|
47 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_fsync, /* check_fsync */ 29, 0 ), |
| 47 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_fsync, /* check_fsync */ 30, 0 ), |
48 | 48 | /* allow socket based on expression */
|
49 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_socket, /* check_socket */ 30, 0 ), |
| 49 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_socket, /* check_socket */ 31, 0 ), |
50 | 50 | /* simply allow connect */
|
51 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_connect, /* RET_ALLOW */ 82, 0 ), |
| 51 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_connect, /* RET_ALLOW */ 83, 0 ), |
52 | 52 | /* allow shutdown based on expression */
|
53 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_shutdown, /* check_shutdown */ 46, 0 ), |
| 53 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_shutdown, /* check_shutdown */ 47, 0 ), |
54 | 54 | /* simply allow close */
|
55 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_close, /* RET_ALLOW */ 80, 0 ), |
| 55 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_close, /* RET_ALLOW */ 81, 0 ), |
56 | 56 | /* allow fcntl based on expression */
|
57 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_fcntl, /* check_fcntl */ 46, 0 ), |
| 57 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_fcntl, /* check_fcntl */ 47, 0 ), |
58 | 58 | /* allow bind based on expression */
|
59 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_bind, /* check_bind */ 49, 0 ), |
| 59 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_bind, /* check_bind */ 50, 0 ), |
60 | 60 | /* simply allow ppoll */
|
61 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_ppoll, /* RET_ALLOW */ 77, 0 ), |
| 61 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_ppoll, /* RET_ALLOW */ 78, 0 ), |
62 | 62 | /* allow setsockopt based on expression */
|
63 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_setsockopt, /* check_setsockopt */ 51, 0 ), |
| 63 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_setsockopt, /* check_setsockopt */ 52, 0 ), |
64 | 64 | /* simply allow getsockname */
|
65 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_getsockname, /* RET_ALLOW */ 75, 0 ), |
| 65 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_getsockname, /* RET_ALLOW */ 76, 0 ), |
66 | 66 | /* simply allow getpid */
|
67 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_getpid, /* RET_ALLOW */ 74, 0 ), |
| 67 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_getpid, /* RET_ALLOW */ 75, 0 ), |
68 | 68 | /* simply allow getrandom */
|
69 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_getrandom, /* RET_ALLOW */ 73, 0 ), |
| 69 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_getrandom, /* RET_ALLOW */ 74, 0 ), |
70 | 70 | /* allow lseek based on expression */
|
71 |
| - BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_lseek, /* check_lseek */ 63, 0 ), |
| 71 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_lseek, /* check_lseek */ 64, 0 ), |
| 72 | + /* simply allow clock_nanosleep */ |
| 73 | + BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, SYS_clock_nanosleep, /* RET_ALLOW */ 72, 0 ), |
72 | 74 | /* none of the syscalls matched */
|
73 | 75 | { BPF_JMP | BPF_JA, 0, 0, /* RET_KILL_PROCESS */ 70 },
|
74 | 76 | // check_recvmsg:
|
|
0 commit comments