On Thursday, September 10, 2015 03:48:52 PM Daniel P. Berrange wrote: > On Wed, Sep 09, 2015 at 09:55:33PM -0400, namn...@safe-mail.net wrote: > > + > > + /* shmget */ > > + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(shmget), 2, > > + SCMP_A0(SCMP_CMP_EQ, IPC_PRIVATE), > > + SCMP_A2(SCMP_CMP_EQ, IP_CREAT|0777)); > > I'm not familiar with semantics of these seccomp rules, but is this > saying that the second arg must be exactly equal to IP_CREAT|0777 ?
Yes. > If the app passes IP_CREAT|0600, would that be permitted instead ? > The latter is what I see gtk2 source code passing for mode. It wouldn't match the rule as written above, if it doesn't match any other configured rules it would hit the default filter action. -- paul moore security @ redhat
