openwrt/package/network/services/umdns/files/umdns.json

{
	"defaultAction": "SCMP_ACT_KILL_PROCESS",
	"syscalls": [
		{
			"names": [
				"bind",
				"brk",
				"clock_gettime",
				"close",
				"connect",
				"epoll_create",
				"epoll_create1",
				"epoll_ctl",
				"epoll_pwait",
				"epoll_wait",
				"exit",
				"exit_group",
				"fcntl",
				"fcntl64",
				"fstat",
				"getsockname",
				"ioctl",
				"open",
				"openat",
				"pipe",
				"pipe2",
				"poll",
				"ppoll",
				"read",
				"recvfrom",
				"recvmsg",
				"rt_sigaction",
				"rt_sigprocmask",
				"rt_sigreturn",
				"sendmsg",
				"sendto",
				"setsockopt",
				"sigreturn",
				"socket",
				"time",
				"uname",
				"write",
				"writev"
			],
			"action": "SCMP_ACT_ALLOW"
		}
	]
}
mdns: add jail and seccomp support Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 45012 2015-03-26 10:58:44 +00:00			`{`
umdns: convert seccomp filter rules to OCI format procd-seccomp switched to OCI-compliant seccomp parser instead of our (legacy, OpenWrt-specific) format. Convert ruleset to new format. Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2020-11-17 13:11:16 +00:00			`"defaultAction": "SCMP_ACT_KILL_PROCESS",`
			`"syscalls": [`
			`{`
			`"names": [`
			`"bind",`
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2021-04-10 16:30:49 +00:00			`"brk",`
			`"clock_gettime",`
			`"close",`
umdns: convert seccomp filter rules to OCI format procd-seccomp switched to OCI-compliant seccomp parser instead of our (legacy, OpenWrt-specific) format. Convert ruleset to new format. Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2020-11-17 13:11:16 +00:00			`"connect",`
			`"epoll_create",`
			`"epoll_create1",`
			`"epoll_ctl",`
			`"epoll_pwait",`
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2021-04-10 16:30:49 +00:00			`"epoll_wait",`
umdns: convert seccomp filter rules to OCI format procd-seccomp switched to OCI-compliant seccomp parser instead of our (legacy, OpenWrt-specific) format. Convert ruleset to new format. Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2020-11-17 13:11:16 +00:00			`"exit",`
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2021-04-10 16:30:49 +00:00			`"exit_group",`
umdns: convert seccomp filter rules to OCI format procd-seccomp switched to OCI-compliant seccomp parser instead of our (legacy, OpenWrt-specific) format. Convert ruleset to new format. Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2020-11-17 13:11:16 +00:00			`"fcntl",`
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2021-04-10 16:30:49 +00:00			`"fcntl64",`
			`"fstat",`
			`"getsockname",`
			`"ioctl",`
			`"open",`
			`"openat",`
			`"pipe",`
			`"pipe2",`
			`"poll",`
			`"ppoll",`
			`"read",`
			`"recvfrom",`
			`"recvmsg",`
			`"rt_sigaction",`
			`"rt_sigprocmask",`
			`"rt_sigreturn",`
			`"sendmsg",`
			`"sendto",`
			`"setsockopt",`
			`"sigreturn",`
			`"socket",`
			`"time",`
			`"uname",`
			`"write",`
			`"writev"`
umdns: convert seccomp filter rules to OCI format procd-seccomp switched to OCI-compliant seccomp parser instead of our (legacy, OpenWrt-specific) format. Convert ruleset to new format. Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2020-11-17 13:11:16 +00:00			`],`
			`"action": "SCMP_ACT_ALLOW"`
			`}`
			`]`
mdns: add jail and seccomp support Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 45012 2015-03-26 10:58:44 +00:00			`}`