mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #1882 from shlevy/no-seccomp-no-filterSyscalls

Browse source 
Don't silently succeed seccomp setup when !HAVE_SECCOMP.
This commit is contained in:
Eelco Dolstra 2018-02-19 17:39:46 +01:00 committed by GitHub
commit 623fcb071e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/libstore/build.cc
View file

@ -2471,9 +2471,9 @@ void DerivationGoal::chownToBuilder(const Path & path)
void setupSeccomp() void setupSeccomp()
{ {
#if __linux__ && HAVE_SECCOMP #if __linux__
if (!settings.filterSyscalls) return; if (!settings.filterSyscalls) return;
#if HAVE_SECCOMP
scmp_filter_ctx ctx; scmp_filter_ctx ctx;
if (!(ctx = seccomp_init(SCMP_ACT_ALLOW))) if (!(ctx = seccomp_init(SCMP_ACT_ALLOW)))
@ -2519,6 +2519,11 @@ void setupSeccomp()
if (seccomp_load(ctx) != 0) if (seccomp_load(ctx) != 0)
throw SysError("unable to load seccomp BPF program"); throw SysError("unable to load seccomp BPF program");
#else
throw Error("%s\n%s",
"seccomp is not supported on this platform"
"you can avoid this by setting the filter-syscalls option to false, but note that untrusted builds can then create setuid binaries!");
#endif
#endif #endif
} }