From db3ee1d862272a36fb23adb208bfe84013e4b8f7 Mon Sep 17 00:00:00 2001 From: Peter Gerber Date: Tue, 22 Jan 2019 21:47:43 +0000 Subject: [PATCH] =?UTF-8?q?Allow=20getsockopt(=E2=80=A6,=20SOL=5FSOCKET,?= =?UTF-8?q?=20SO=5FACCEPTCONN,=20=E2=80=A6)=20in=20sandbox?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SO_ACCEPTCONN checks whether socket listening is enabled and is used ever since 9369152aae9527cc3764 has been merged. Closes ticket #29150 --- src/lib/sandbox/sandbox.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index 1f0f5d858f..b652397f5a 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -832,6 +832,12 @@ sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (rc) return rc; + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_ACCEPTCONN)); + if (rc) + return rc; + #ifdef HAVE_SYSTEMD rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),