mirror/emacs
1
0
Fork 0
mirror of https://git.savannah.gnu.org/git/emacs.git synced 2024-11-23 07:19:15 +00:00
Code Issues Releases Activity
146,359 Commits 226 Branches 189 Tags 500 MiB
ef6df9ec8f
Commit Graph

8 Commits

Author SHA1 Message Date
Philipp Stephani
104c5e3d57 * lib-src/seccomp-filter.c: Add missing headers. 2021-04-12 09:20:51 +02:00
Philipp Stephani
c8d542fd59 Add a variant of the Seccomp filter file that allows 'execve'. 
This is useful when starting Emacs with a Seccomp filter enabled,
e.g. using 'bwrap'.

* lib-src/seccomp-filter.c (main): Generate new Seccomp files.

* lib-src/Makefile.in (all)
(seccomp-filter.bpf seccomp-filter.pfc seccomp-filter-exec.bpf
seccomp-filter-exec.pfc): Generate new Seccomp files.

* .gitignore: Ignore new Seccomp files.

* test/src/emacs-tests.el (emacs-tests/bwrap/allows-stdout): New unit
test.
 2021-04-11 21:19:09 +02:00
Philipp Stephani
cf0701eff0 * lib-src/seccomp-filter.c (main): Also allow O_NOFOLLOW. 2021-04-11 21:14:41 +02:00
Philipp Stephani
ea5ea09244 Seccomp filter: allow reading the current time (Bug#47708). 
* lib-src/seccomp-filter.c (main): Allow reading the current time.
 2021-04-11 19:50:45 +02:00
Philipp Stephani
d06c54db1b Remove SCMP_FLTATR_CTL_LOG attribute from Seccomp filter. 
Whether or not we log failing syscalls isn't security-critical, and we
shouldn't care.

* lib-src/seccomp-filter.c (main): Remove log attribute.
 2021-04-11 16:41:44 +02:00
Philipp Stephani
5537836288 * lib-src/seccomp-filter.c: Print trailing newline. 2021-04-11 16:03:08 +02:00
Glenn Morris
81ffc43383 ; Fix copyright years 2021-04-10 12:24:09 -07:00
Philipp Stephani
1060289f51 Add a helper binary to create a basic Secure Computing filter. 
The binary uses the 'seccomp' helper library.  The library isn't
needed to load the generated Secure Computing filter.

* configure.ac: Check for 'seccomp' header and library.

* lib-src/seccomp-filter.c: New helper binary to generate a generic
Secure Computing filter for GNU/Linux.

* lib-src/Makefile.in (DONT_INSTALL): Add 'seccomp-filter' helper
binary if possible.
(all): Add Secure Computing filter file if possible.
(seccomp-filter$(EXEEXT)): Compile helper binary.
(seccomp-filter.bpf seccomp-filter.pfc): Generate filter files.

* test/src/emacs-tests.el (emacs-tests/seccomp/allows-stdout)
(emacs-tests/seccomp/forbids-subprocess): New unit tests.

* test/Makefile.in (src/emacs-tests.log): Add dependency on the helper
binary.
 2021-04-10 21:10:16 +02:00