| 47 | |
| 48 | |
| 49 | static int difficult_filter(void) |
| 50 | { |
| 51 | struct sock_filter filter[] = { |
| 52 | /* Grab the system call number. */ |
| 53 | EXAMINE_SYSCALL, |
| 54 | /* List allowed syscalls. */ |
| 55 | DISALLOW_SYSCALL(execve), |
| 56 | DISALLOW_SYSCALL(execveat), |
| 57 | DISALLOW_SYSCALL(open), |
| 58 | DISALLOW_SYSCALL(openat), |
| 59 | ALLOW_PROCESS, |
| 60 | }; |
| 61 | struct sock_fprog prog = { |
| 62 | .len = (unsigned short)(sizeof(filter)/sizeof(filter[0])), |
| 63 | .filter = filter, |
| 64 | }; |
| 65 | |
| 66 | if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { |
| 67 | printf("prctl(NO_NEW_PRIVS)"); |
| 68 | goto failed; |
| 69 | } |
| 70 | if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) { |
| 71 | printf("prctl(SECCOMP)"); |
| 72 | goto failed; |
| 73 | } |
| 74 | return 0; |
| 75 | |
| 76 | failed: |
| 77 | if (errno == EINVAL){ |
| 78 | printf("SECCOMP_FILTER is not available. :(\n"); |
| 79 | exit(0); |
| 80 | } |
| 81 | return 1; |
| 82 | } |
| 83 | |
| 84 | static int good_luck_filter(void) |
| 85 | { |