DWS/chrony
1
0
Fork 0
mirror of https://gitlab.com/chrony/chrony.git synced 2026-03-11 00:59:38 -04:00
Code Issues Packages Projects Releases Wiki Activity

privops: enable system call filter

Browse Source 
In preparation of OpenBSD support, add SYS_EnableSystemCallFilter() call
to PRV_StartHelper().

In OpenBSD the privops helper will use a system call filter (pledge(2)),
whereas in Linux the privops helper doesn't use any system call filter
at the moment.

Modify Unit test ntp_sources call to PRV_Initialise() with parameter
scfilter_level set to 0.
This commit is contained in:
Thomas Kupper
2026-02-11 07:53:41 +01:00
committed by Miroslav Lichvar
parent cda67351ae
commit fd60dabde7
6 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
privops.c
View File

@@ -34,6 +34,7 @@
#include "logging.h"
#include "privops.h"
#include "socket.h"
#include "sys.h"
#include "util.h"
#define OP_ADJUSTTIME 1024
@@ -131,6 +132,7 @@ typedef struct {
static int helper_fd;
static pid_t helper_pid;
static int scfilter_level;
static int
have_helper(void)
@@ -624,9 +626,10 @@ PRV_ReloadDNS(void)
/* ======================================================================= */
void
PRV_Initialise(void)
PRV_Initialise(int level)
{
helper_fd = -1;
scfilter_level = level;
}
/* ======================================================================= */
@@ -667,6 +670,9 @@ PRV_StartHelper(void)
/* ignore signals, the process will exit on OP_QUIT request */
UTI_SetQuitSignalsHandler(SIG_IGN, 1);
if (scfilter_level != 0)
SYS_EnableSystemCallFilter(scfilter_level, SYS_PRIVOPS_HELPER);
helper_main(sock_fd2);
} else {