mirror of
https://github.com/systemd/systemd
synced 2024-09-30 05:15:19 +00:00
core: do not filter out write() if required in the very late stage
Before12001b1bf0
, write() is required for if Type=exec. However, with the previous commit, now write() is also used for sending handoff timestamp. Let's allow write() if necessary. Fixes a regression caused by12001b1bf0
. Fixes #33299.
This commit is contained in:
parent
5161422bb5
commit
84b79215cc
|
@ -1439,6 +1439,13 @@ static int apply_syscall_filter(const ExecContext *c, const ExecParameters *p, b
|
|||
return r;
|
||||
}
|
||||
|
||||
/* Sending over exec_fd or handoff_timestamp_fd requires write() syscall. */
|
||||
if (p->exec_fd >= 0 || p->handoff_timestamp_fd >= 0) {
|
||||
r = seccomp_filter_set_add_by_name(c->syscall_filter, c->syscall_allow_list, "write");
|
||||
if (r < 0)
|
||||
return r;
|
||||
}
|
||||
|
||||
return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action, false);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue