diff options
| author | Stefano Brivio <sbrivio@redhat.com> | 2022-07-13 03:36:09 +0200 |
|---|---|---|
| committer | Stefano Brivio <sbrivio@redhat.com> | 2022-07-14 01:36:05 +0200 |
| commit | 1d223e4b4c3b625383ceb368deb8d01e755a585f (patch) | |
| tree | 280c0a5711eea94ef463e26bff5f0bff43937117 /README.md | |
| parent | 17689cc9bf52feb5d31fdbf279f6137f1d6446cb (diff) | |
| download | passt-1d223e4b4c3b625383ceb368deb8d01e755a585f.tar passt-1d223e4b4c3b625383ceb368deb8d01e755a585f.tar.gz passt-1d223e4b4c3b625383ceb368deb8d01e755a585f.tar.bz2 passt-1d223e4b4c3b625383ceb368deb8d01e755a585f.tar.lz passt-1d223e4b4c3b625383ceb368deb8d01e755a585f.tar.xz passt-1d223e4b4c3b625383ceb368deb8d01e755a585f.tar.zst passt-1d223e4b4c3b625383ceb368deb8d01e755a585f.zip | |
passt: Allow exit_group() system call in seccomp profiles
We handle SIGQUIT and SIGTERM calling exit(), which is usually
implemented with the exit_group() system call.
If we don't allow exit_group(), we'll get a SIGSYS while handling
SIGQUIT and SIGTERM, which means a misleading non-zero exit code.
Reported-by: Wenli Quan <wquan@redhat.com>
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2101990
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -286,7 +286,7 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ✅ all capabilities dropped, other than `CAP_NET_BIND_SERVICE` (if granted) * ✅ with default options, user, mount, IPC, UTS, PID namespaces are detached * ✅ no external dependencies (other than a standard C library) -* ✅ restrictive seccomp profiles (25 syscalls allowed for _passt_, 39 for +* ✅ restrictive seccomp profiles (26 syscalls allowed for _passt_, 40 for _pasta_ on x86_64) * ✅ examples of [AppArmor](/passt/tree/contrib/apparmor) and [SELinux](/passt/tree/contrib/selinux) profiles available |