diff options
| author | practicalswift <practicalswift@users.noreply.github.com> | 2021-10-01 13:53:59 +0000 |
|---|---|---|
| committer | practicalswift <practicalswift@users.noreply.github.com> | 2021-10-01 13:51:10 +0000 |
| commit | 4747da3a5b639b5a336b737e7e3cbf060cf2efcf (patch) | |
| tree | c375c8eff3a7f4b02f66247b52dfee286e7fcbae /src/net.cpp | |
| parent | e69cbac628bfdca4a8e4ead821190eaf5b6b3d07 (diff) | |
Add syscall sandboxing (seccomp-bpf)
Diffstat (limited to 'src/net.cpp')
| -rw-r--r-- | src/net.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/net.cpp b/src/net.cpp index cc8f4c4316..cceb5b2199 100644 --- a/src/net.cpp +++ b/src/net.cpp @@ -25,6 +25,7 @@ #include <scheduler.h> #include <util/sock.h> #include <util/strencodings.h> +#include <util/syscall_sandbox.h> #include <util/system.h> #include <util/thread.h> #include <util/trace.h> @@ -1615,6 +1616,7 @@ void CConnman::SocketHandler() void CConnman::ThreadSocketHandler() { + SetSyscallSandboxPolicy(SyscallSandboxPolicy::NET); while (!interruptNet) { DisconnectNodes(); @@ -1634,6 +1636,7 @@ void CConnman::WakeMessageHandler() void CConnman::ThreadDNSAddressSeed() { + SetSyscallSandboxPolicy(SyscallSandboxPolicy::INITIALIZATION_DNS_SEED); FastRandomContext rng; std::vector<std::string> seeds = Params().DNSSeeds(); Shuffle(seeds.begin(), seeds.end(), rng); @@ -1816,6 +1819,7 @@ int CConnman::GetExtraBlockRelayCount() const void CConnman::ThreadOpenConnections(const std::vector<std::string> connect) { + SetSyscallSandboxPolicy(SyscallSandboxPolicy::NET_OPEN_CONNECTION); // Connect to specific addresses if (!connect.empty()) { @@ -2155,6 +2159,7 @@ std::vector<AddedNodeInfo> CConnman::GetAddedNodeInfo() const void CConnman::ThreadOpenAddedConnections() { + SetSyscallSandboxPolicy(SyscallSandboxPolicy::NET_ADD_CONNECTION); while (true) { CSemaphoreGrant grant(*semAddnode); @@ -2218,6 +2223,7 @@ void CConnman::OpenNetworkConnection(const CAddress& addrConnect, bool fCountFai void CConnman::ThreadMessageHandler() { + SetSyscallSandboxPolicy(SyscallSandboxPolicy::MESSAGE_HANDLER); FastRandomContext rng; while (!flagInterruptMsgProc) { |