434faeecb8
The Linux secure computing (seccomp) facility allows a process to install a filter in the kernel that will allow only specific system calls to be made. The process is killed when trying to make other system calls. This is useful to reduce the kernel attack surface and possibly prevent kernel exploits when the process is compromised. Use the libseccomp library to add rules and load the filter into the kernel. Keep a list of system calls that are always allowed after chronyd is initialized. Restrict arguments that may be passed to the socket(), setsockopt(), fcntl(), and ioctl() system calls. Arguments to socketcall(), which is used on some architectures as a multiplexer instead of separate socket system calls, are not restricted for now. The mailonchange directive is not allowed as it calls sendmail. Calls made by the libraries that chronyd is using have to be covered too. It's difficult to determine which system calls they need as it may change after an upgrade and it may depend on their configuration (e.g. resolver in libc). There are also differences between architectures. It can all break very easily and is therefore disabled by default. It can be enabled with the new -F option. This is based on a patch from Andrew Griffiths <agriffit@redhat.com>.
48 lines
1.7 KiB
C
48 lines
1.7 KiB
C
/*
|
|
chronyd/chronyc - Programs for keeping computer clocks accurate.
|
|
|
|
**********************************************************************
|
|
* Copyright (C) Richard P. Curnow 1997-2002
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of version 2 of the GNU General Public License as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
*
|
|
**********************************************************************
|
|
|
|
=======================================================================
|
|
|
|
This is the header for the file that links in the operating system-
|
|
specific parts of the software
|
|
|
|
*/
|
|
|
|
#ifndef GOT_SYS_H
|
|
#define GOT_SYS_H
|
|
|
|
/* Called at the start of the run to do initialisation */
|
|
extern void SYS_Initialise(void);
|
|
|
|
/* Called at the end of the run to do final clean-up */
|
|
extern void SYS_Finalise(void);
|
|
|
|
/* Drop root privileges to the specified user and group */
|
|
extern void SYS_DropRoot(uid_t uid, gid_t gid);
|
|
|
|
/* Enable a system call filter to allow only system calls
|
|
which chronyd normally needs after initialization */
|
|
extern void SYS_EnableSystemCallFilter(int level);
|
|
|
|
extern void SYS_SetScheduler(int SchedPriority);
|
|
extern void SYS_LockMemory(void);
|
|
|
|
#endif /* GOT_SYS_H */
|