diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c index b5cda70b..f80981fa 100644 --- a/sandbox-seccomp-filter.c +++ b/sandbox-seccomp-filter.c @@ -177,6 +177,9 @@ static const struct sock_filter preauth_insns[] = { #ifdef __NR_shmdt SC_DENY(__NR_shmdt, EACCES), #endif +#ifdef __NR_ipc + SC_DENY(__NR_ipc, EACCES), +#endif /* Syscalls to permit */ #ifdef __NR_brk @@ -185,6 +188,9 @@ static const struct sock_filter preauth_insns[] = { #ifdef __NR_clock_gettime SC_ALLOW(__NR_clock_gettime), #endif +#ifdef __NR_clock_gettime64 + SC_ALLOW(__NR_clock_gettime64), +#endif #ifdef __NR_close SC_ALLOW(__NR_close), #endif @@ -242,6 +248,15 @@ static const struct sock_filter preauth_insns[] = { #ifdef __NR_nanosleep SC_ALLOW(__NR_nanosleep), #endif +#ifdef __NR_clock_nanosleep + SC_ALLOW(__NR_clock_nanosleep), +#endif +#ifdef __NR_clock_nanosleep_time64 + SC_ALLOW(__NR_clock_nanosleep_time64), +#endif +#ifdef __NR_clock_gettime64 + SC_ALLOW(__NR_clock_gettime64), +#endif #ifdef __NR__newselect SC_ALLOW(__NR__newselect), #endif