summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--sandbox-seccomp-filter.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index 2e1ed2c52..62c578d3c 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -137,6 +137,15 @@ static const struct sock_filter preauth_insns[] = {
137#endif 137#endif
138#ifdef __NR_clock_gettime 138#ifdef __NR_clock_gettime
139 SC_ALLOW(clock_gettime), 139 SC_ALLOW(clock_gettime),
140# if defined(__x86_64__) && defined(__ILP32__)
141 /* On Linux x32, the clock_gettime VDSO currently falls back to the
142 * x86-64 syscall (see https://bugs.debian.org/849923), so allow
143 * that too.
144 */
145 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K,
146 __NR_clock_gettime & ~__X32_SYSCALL_BIT, 0, 1),
147 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
148# endif
140#endif 149#endif
141#ifdef __NR_close 150#ifdef __NR_close
142 SC_ALLOW(close), 151 SC_ALLOW(close),