diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-01-25 12:35:47 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-01-25 12:35:47 +0900 |
| commit | 37780456a75c08652bd191d0e9c2bb9077198dc4 (patch) | |
| tree | 1b2fb59a4ed572ca6fea1ea6dee1894d62e44800 /helper/bwrap/seccomp-export.h | |
| parent | efacaa40fae42238e869524a5c2dca5ec7d94b3d (diff) | |
helper: block more unusual/privileged syscalls
These are toggled by F_EXT and exposed as SyscallPolicy.Compat in the Go interface.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'helper/bwrap/seccomp-export.h')
| -rw-r--r-- | helper/bwrap/seccomp-export.h | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/helper/bwrap/seccomp-export.h b/helper/bwrap/seccomp-export.h index 5df0dc65..90640d8f 100644 --- a/helper/bwrap/seccomp-export.h +++ b/helper/bwrap/seccomp-export.h @@ -8,13 +8,14 @@ #endif typedef enum { - F_DENY_NS = 1 << 0, - F_DENY_TTY = 1 << 1, - F_DENY_DEVEL = 1 << 2, - F_MULTIARCH = 1 << 3, - F_LINUX32 = 1 << 4, - F_CAN = 1 << 5, - F_BLUETOOTH = 1 << 6, + F_EXT = 1 << 0, + F_DENY_NS = 1 << 1, + F_DENY_TTY = 1 << 2, + F_DENY_DEVEL = 1 << 3, + F_MULTIARCH = 1 << 4, + F_LINUX32 = 1 << 5, + F_CAN = 1 << 6, + F_BLUETOOTH = 1 << 7, } f_syscall_opts; extern void F_println(char *v); |