4f8bde99c1
Only allow system calls that are needed by virtiofsd. All other system calls cause SIGSYS to be directed at the thread and the process will coredump. Restricting system calls reduces the kernel attack surface and limits what the process can do when compromised. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> with additional entries by: Signed-off-by: Ganesh Maharaj Mahalingam <ganesh.mahalingam@intel.com> Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Signed-off-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Signed-off-by: piaojun <piaojun@huawei.com> Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Signed-off-by: Eric Ren <renzhen@linux.alibaba.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
13 lines
363 B
Makefile
13 lines
363 B
Makefile
virtiofsd-obj-y = buffer.o \
|
|
fuse_opt.o \
|
|
fuse_log.o \
|
|
fuse_lowlevel.o \
|
|
fuse_signals.o \
|
|
fuse_virtio.o \
|
|
helper.o \
|
|
passthrough_ll.o \
|
|
seccomp.o
|
|
|
|
seccomp.o-cflags := $(SECCOMP_CFLAGS)
|
|
seccomp.o-libs := $(SECCOMP_LIBS)
|