From 1d223e4b4c3b625383ceb368deb8d01e755a585f Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Wed, 13 Jul 2022 03:36:09 +0200 Subject: passt: Allow exit_group() system call in seccomp profiles We handle SIGQUIT and SIGTERM calling exit(), which is usually implemented with the exit_group() system call. If we don't allow exit_group(), we'll get a SIGSYS while handling SIGQUIT and SIGTERM, which means a misleading non-zero exit code. Reported-by: Wenli Quan Link: https://bugzilla.redhat.com/show_bug.cgi?id=2101990 Signed-off-by: Stefano Brivio --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'README.md') diff --git a/README.md b/README.md index 4fed6d5..628b9bb 100644 --- a/README.md +++ b/README.md @@ -286,7 +286,7 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ✅ all capabilities dropped, other than `CAP_NET_BIND_SERVICE` (if granted) * ✅ with default options, user, mount, IPC, UTS, PID namespaces are detached * ✅ no external dependencies (other than a standard C library) -* ✅ restrictive seccomp profiles (25 syscalls allowed for _passt_, 39 for +* ✅ restrictive seccomp profiles (26 syscalls allowed for _passt_, 40 for _pasta_ on x86_64) * ✅ examples of [AppArmor](/passt/tree/contrib/apparmor) and [SELinux](/passt/tree/contrib/selinux) profiles available -- cgit v1.2.3