ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2024-12-29 18:19:02 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity
dee4309bdf
openwrt/package/network/services/umdns/files/umdns.json

58 lines
846 B
JSON
Raw Normal View History

mdns: add jail and seccomp support Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 45012
2015-03-26 10:58:44 +00:00
{
umdns: convert seccomp filter rules to OCI format procd-seccomp switched to OCI-compliant seccomp parser instead of our (legacy, OpenWrt-specific) format. Convert ruleset to new format. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2020-11-17 13:11:16 +00:00
"defaultAction": "SCMP_ACT_KILL_PROCESS",
"syscalls": [
{
"names": [
"bind",
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-04-10 16:30:49 +00:00
"brk",
"clock_gettime",
umdns: add missing syscall to seccomp filter The 'clock_gettime64', syscall is missing. Found with 'utrace /usr/sbin/umdns' on an R7800. Signed-off-by: Michael Peleshenko <mpeleshenko@gmail.com>
2021-10-21 22:14:05 +00:00
"clock_gettime64",
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-04-10 16:30:49 +00:00
"close",
umdns: convert seccomp filter rules to OCI format procd-seccomp switched to OCI-compliant seccomp parser instead of our (legacy, OpenWrt-specific) format. Convert ruleset to new format. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2020-11-17 13:11:16 +00:00
"connect",
"epoll_create",
"epoll_create1",
"epoll_ctl",
"epoll_pwait",
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-04-10 16:30:49 +00:00
"epoll_wait",
umdns: convert seccomp filter rules to OCI format procd-seccomp switched to OCI-compliant seccomp parser instead of our (legacy, OpenWrt-specific) format. Convert ruleset to new format. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2020-11-17 13:11:16 +00:00
"exit",
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-04-10 16:30:49 +00:00
"exit_group",
umdns: convert seccomp filter rules to OCI format procd-seccomp switched to OCI-compliant seccomp parser instead of our (legacy, OpenWrt-specific) format. Convert ruleset to new format. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2020-11-17 13:11:16 +00:00
"fcntl",
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-04-10 16:30:49 +00:00
"fcntl64",
"fstat",
umdns: add missing syscall to seccomp filter There is some syscall missing: 'getdents64' 'getrandom' 'statx' 'newfstatat' Found with: 'mkdir /etc/umdns; ln -s /tmp/1.json /etc/umdns/; utrace /usr/sbin/umdns' Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
2022-07-30 21:04:58 +00:00
"getdents64",
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-04-10 16:30:49 +00:00
"getsockname",
umdns: add missing syscall to seccomp filter There is some syscall missing: 'getdents64' 'getrandom' 'statx' 'newfstatat' Found with: 'mkdir /etc/umdns; ln -s /tmp/1.json /etc/umdns/; utrace /usr/sbin/umdns' Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
2022-07-30 21:04:58 +00:00
"getrandom",
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-04-10 16:30:49 +00:00
"ioctl",
umdns: add missing syscall to seccomp filter The 'madvise', syscall is missing. Found with 'utrace /usr/sbin/umdns' on an R7800 and RT3200. Signed-off-by: Michael Peleshenko <mpeleshenko@gmail.com>
2021-10-26 00:12:57 +00:00
"madvise",
umdns: add missing syscalls to seccomp filter The 'mmap', 'mmap2', 'munmap' syscalls are missing. Found with 'utrace /usr/sbin/umdns'. Signed-off-by: Ronny Kotzschmar <ro.ok@me.com>
2021-10-07 13:28:13 +00:00
"mmap",
"mmap2",
"munmap",
umdns: add missing syscall to seccomp filter There is some syscall missing: 'getdents64' 'getrandom' 'statx' 'newfstatat' Found with: 'mkdir /etc/umdns; ln -s /tmp/1.json /etc/umdns/; utrace /usr/sbin/umdns' Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
2022-07-30 21:04:58 +00:00
"newfstatat",
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-04-10 16:30:49 +00:00
"open",
"openat",
"pipe",
"pipe2",
"poll",
"ppoll",
"read",
"recvfrom",
"recvmsg",
"rt_sigaction",
"rt_sigprocmask",
"rt_sigreturn",
"sendmsg",
"sendto",
"setsockopt",
"sigreturn",
"socket",
umdns: add missing syscall to seccomp filter There is some syscall missing: 'getdents64' 'getrandom' 'statx' 'newfstatat' Found with: 'mkdir /etc/umdns; ln -s /tmp/1.json /etc/umdns/; utrace /usr/sbin/umdns' Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
2022-07-30 21:04:58 +00:00
"statx",
umdns: add missing syscalls to seccomp filter Looks like 'openat', 'pipe2' and 'ppoll' are now needed, possibly due to changes on libraries used by umdns now using slightly different calls. Found using /etc/init.d/umdns trace now use umdns, ie. cover all ubus call etc., then /etc/init.d/umdns stop find list of syscalls traced in /tmp/umdns.*.json Fixes: FS#3355 ("UMDNS: does not start on master with seccomp") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-04-10 16:30:49 +00:00
"time",
"uname",
"write",
"writev"
umdns: convert seccomp filter rules to OCI format procd-seccomp switched to OCI-compliant seccomp parser instead of our (legacy, OpenWrt-specific) format. Convert ruleset to new format. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2020-11-17 13:11:16 +00:00
],
"action": "SCMP_ACT_ALLOW"
}
]
mdns: add jail and seccomp support Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 45012
2015-03-26 10:58:44 +00:00
}
Reference in New Issue Copy Permalink