From 4f0e893cd3889acb8e3d40d359610749189adc25 Mon Sep 17 00:00:00 2001
From: Omar Polo <op@omarpolo.com>
Date: Sun, 13 Feb 2022 16:20:27 +0000
Subject: tightens seccomp filter: allow only openat(O_RDONLY)

be more strict and allow an openat only with the O_RDONLY flag.  This
is kind of redundant with landlock, but still good to have.  Landlock
is not yet widely available and won't kill the process upon policy
violation; furthermore, landlock can be disabled at boot time.

tested on GNU and musl libc on arch and alpine amd64.
---
 sandbox.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'sandbox.c')

diff --git a/sandbox.c b/sandbox.c
index 8881cbb..0ab50d1 100644
--- a/sandbox.c
+++ b/sandbox.c
@@ -354,7 +354,7 @@ static struct sock_filter filter[] = {
 	SC_ALLOW(oldfstat),
 #endif
 #ifdef __NR_openat
-	SC_ALLOW(openat),
+	SC_ALLOW_ARG(__NR_openat, 3, O_RDONLY),
 #endif
 #ifdef __NR_prlimit64
 	SC_ALLOW(prlimit64),
-- 
cgit v1.2.3