commit f64062b1f74ad5ee20a8a49aab2732efd0f7ce30
author Damien Miller <djm@mindrot.org> Fri May 20 09:56:53 2016 +1000
committer Damien Miller <djm@mindrot.org> Fri May 20 09:56:53 2016 +1000
tree 1b842e4810e86495a65474a9a54070e50ae92952
parent 531c135409b8d8810795b1f3692a4ebfd5c9cae0

Deny lstat syscalls in seccomp sandbox

Avoids sandbox violations for some krb/gssapi libraries.

sandbox-seccomp-filter.c

diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index d132e26..2e1ed2c 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -103,6 +103,12 @@
 		offsetof(struct seccomp_data, nr)),
 
 	/* Syscalls to non-fatally deny */
+#ifdef __NR_lstat
+	SC_DENY(lstat, EACCES),
+#endif
+#ifdef __NR_lstat64
+	SC_DENY(lstat64, EACCES),
+#endif
 #ifdef __NR_fstat
 	SC_DENY(fstat, EACCES),
 #endif