woj/nsjail
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nsjail: free seccomp filter upon nsjail exit

Browse Source
This commit is contained in:
Robert Swiecki 2018-02-12 17:09:45 +01:00
parent 8a22a4abb6
commit 2545fcd3a9
4 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmdline.cc
View File

@ -363,6 +363,8 @@ std::unique_ptr<nsjconf_t> parseArgs(int argc, char* argv[]) {
nsjconf->iface_vs_gw = "0.0.0.0";
nsjconf->orig_uid = getuid();
nsjconf->num_cpus = sysconf(_SC_NPROCESSORS_ONLN);
nsjconf->seccomp_fprog.filter = NULL;
nsjconf->seccomp_fprog.len = 0;
nsjconf->openfds.push_back(STDIN_FILENO);
nsjconf->openfds.push_back(STDOUT_FILENO);

6
nsjail.cc
View File

@ -179,10 +179,12 @@ int main(int argc, char* argv[]) {
LOG_F("Couldn't prepare sandboxing policy");
}
int ret = 0;
if (nsjconf->mode == MODE_LISTEN_TCP) {
nsjailListenMode(nsjconf.get());
} else {
return nsjailStandaloneMode(nsjconf.get());
ret = nsjailStandaloneMode(nsjconf.get());
}
return 0;
sandbox::closePolicy(nsjconf.get());
return ret;
}

9
sandbox.cc
View File

@ -95,4 +95,13 @@ bool preparePolicy(nsjconf_t* nsjconf) {
return true;
}
void closePolicy(nsjconf_t* nsjconf) {
if (!nsjconf->seccomp_fprog.filter) {
return;
}
free(nsjconf->seccomp_fprog.filter);
nsjconf->seccomp_fprog.filter = nullptr;
nsjconf->seccomp_fprog.len = 0;
}
} // namespace sandbox

1
sandbox.h
View File

@ -30,6 +30,7 @@ namespace sandbox {
bool applyPolicy(nsjconf_t* nsjconf);
bool preparePolicy(nsjconf_t* nsjconf);
void closePolicy(nsjconf_t* nsjconf);
} // namespace sandbox