mirrors
/
kore
mirror of https://git.kore.io/kore.git
1
0
Fork 1
Code Issues Projects Releases Wiki Activity
kore/misc/linux-platform.sh

24 lines
389 B
Bash
Raw Normal View History

Add seccomp syscall filtering to kore. With this commit all Kore processes (minus the parent) are running under seccomp. The worker processes get the bare minimum allowed syscalls while each module like curl, pgsql, etc will add their own filters to allow what they require. New API functions: int kore_seccomp_filter(const char *name, void *filter, size_t len); Adds a filter into the seccomp system (must be called before seccomp is enabled). New helpful macro: define KORE_SYSCALL_ALLOW(name) Allow the syscall with a given name, should be used in a sock_filter data structure. New hooks: void kore_seccomp_hook(void); Called before seccomp is enabled, allows developers to add their own BPF filters into seccomp.
2019-09-25 14:25:49 +02:00
#!/bin/sh
PLATFORM=$(uname -m)
case "$PLATFORM" in
x86_64*)
seccomp_audit_arch=AUDIT_ARCH_X86_64
;;
i*86*)
seccomp_audit_arch=AUDIT_ARCH_I386
;;
arm*)
seccomp_audit_arch=AUDIT_ARCH_ARM
;;
aarch64*)
seccomp_audit_arch=AUDIT_ARCH_AARCH64
;;
esac
cat << __EOF
/* Auto generated by linux-platform.sh - DO NOT EDIT */
#define SECCOMP_AUDIT_ARCH $seccomp_audit_arch
__EOF