IP to Geo

IP to Geo Commit Details

Date:2016-02-17 18:15:04 (4 years 5 months ago)
Author:Grégory Soutadé
Branch:master
Commit:3152fbf947c36b43b0e04d64738ea7bb29aba13d
Parents: 3f69fdc7fb707ac0239d65d7dc6d126a475f5b83
Message:Add more seccomp syscalls

Changes:
MREADME (1 diff)
Msrc/Makefile (1 diff)
Msrc/server.c (4 diffs)

File differences

README
1616
1717
1818
19
20
21
22
1923
make data src
Makefile flags :
* DEBUG=1 to compile in debug mode
* USE_SECCOMP=1 to compile with seccomp support
More information can be found at http://indefero.soutade.fr/p/iptogeo
src/Makefile
1111
1212
1313
14
14
1515
1616
1717
CFLAGS += -O2
endif
ifneq ($(DISABLE_SECCOMP),)
ifeq ($(USE_SECCOMP),1)
CFLAGS += -DUSE_SECCOMP=1
LDFLAGS += -lseccomp
endif
src/server.c
2222
2323
2424
25
2526
2627
2728
......
3334
3435
3536
37
3638
3739
3840
......
466468
467469
468470
469
471
470472
471473
472474
......
474476
475477
476478
479
477480
478481
479482
480483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
481510
482511
483512
#include <sys/socket.h>
#include <sys/select.h>
#include <sys/time.h>
#include <sys/stat.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include <time.h>
#include <stdlib.h>
#include <string.h>
#include <poll.h>
#include <fcntl.h>
#ifdef USE_SECCOMP
#include <seccomp.h>
signal(SIGUSR2, sigint);
#ifdef USE_SECCOMP
scmp_filter_ctx seccomp_ctx = seccomp_init(SCMP_ACT_KILL);
scmp_filter_ctx seccomp_ctx = seccomp_init(SCMP_ACT_KILL/*SCMP_ACT_TRAP*/);
if (seccomp_ctx == NULL)
{
return -5;
}
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(poll), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(close), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(accept), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(syncfs), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(nanosleep), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(restart_syscall), 0); // for usleep
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(syslog), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(sendto), 0); // For syslog
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 1, SCMP_A1(SCMP_CMP_EQ , O_RDONLY|O_CLOEXEC));
// For create_thread
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(munmap), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(clone), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(fstat), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(access), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(set_robust_list), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(madvise), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(munlock), 0);
seccomp_rule_add(seccomp_ctx, SCMP_ACT_ALLOW, SCMP_SYS(futex), 0);
ret = seccomp_load(seccomp_ctx);
if (ret < 0)
{
syslog(LOG_ERR, "Error seccomp load %d\n", ret);
return -6;
}
#endif
while (!s_stop)

Archive Download the corresponding diff file

Branches

Tags