- (djm) [sandbox-seccomp-filter.c] Soft-fail stat() syscalls. Add XXX to

   remind myself to add sandbox violation logging via the log socket.

1 files changed, 3 insertions, 0 deletions

diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index c0c17c2fc..c2be00696 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -25,6 +25,8 @@
  */
 /* #define SANDBOX_SECCOMP_FILTER_DEBUG 1 */
 
+/* XXX it should be possible to do logging via the log socket safely */
+
 #ifdef SANDBOX_SECCOMP_FILTER_DEBUG
 /* Use the kernel headers in case of an older toolchain. */
 # include <asm/siginfo.h>
@@ -89,6 +91,7 @@ static const struct sock_filter preauth_insns[] = {
         BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
                 offsetof(struct seccomp_data, nr)),
         SC_DENY(open, EACCES),
+        SC_DENY(stat, EACCES),
         SC_ALLOW(getpid),
         SC_ALLOW(gettimeofday),
         SC_ALLOW(clock_gettime),