woj/nsjail
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

configs: block sched_setaffinity where max_cpus is used

Browse Source
This commit is contained in:
Robert Swiecki 2022-08-09 16:38:12 +02:00
parent b3fcc30aec
commit 30c81ce01f
3 changed files with 20 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
configs/bash-with-fake-geteuid.cfg
View File

@ -176,7 +176,7 @@ mount {
}
seccomp_string: "ERRNO(1337) { geteuid } "
seccomp_string: "ERRNO(0) { ptrace } "
seccomp_string: "ERRNO(1) { ptrace, sched_setaffinity } "
seccomp_string: "KILL_PROCESS { syslog } "
seccomp_string: "DEFAULT ALLOW "

15
configs/xchat-with-net.cfg
View File

@ -133,12 +133,15 @@ mount {
is_bind: true
}
seccomp_string: "KILL_PROCESS {"
seccomp_string: " ptrace,"
seccomp_string: " process_vm_readv,"
seccomp_string: " process_vm_writev"
seccomp_string: "}"
seccomp_string: "DEFAULT ALLOW"
seccomp_string: "KILL_PROCESS { "
seccomp_string: " ptrace, "
seccomp_string: " process_vm_readv, "
seccomp_string: " process_vm_writev "
seccomp_string: "}, "
seccomp_string: "ERRNO(1) { "
seccomp_string: " sched_setaffinity "
seccomp_string: "} "
seccomp_string: "DEFAULT ALLOW "
exec_bin {
path: "/usr/bin/xchat"

16
configs/znc-with-net.cfg
View File

@ -15,6 +15,7 @@ cwd: "/home/znc"
daemon: true
time_limit: 0
max_cpus: 1
envar: "HOME=/home/znc"
envar: "TMP=/tmp"
@ -122,12 +123,15 @@ mount {
mandatory: true
}
seccomp_string: "KILL_PROCESS {"
seccomp_string: " ptrace,"
seccomp_string: " process_vm_readv,"
seccomp_string: " process_vm_writev"
seccomp_string: "}"
seccomp_string: "DEFAULT ALLOW"
seccomp_string: "KILL_PROCESS { "
seccomp_string: " ptrace, "
seccomp_string: " process_vm_readv, "
seccomp_string: " process_vm_writev "
seccomp_string: "}, "
seccomp_string: "ERRNO(1) { "
seccomp_string: " sched_setaffinity "
seccomp_string: "} "
seccomp_string: "DEFAULT ALLOW "
exec_bin {
path: "/usr/bin/znc"