public/seccomp-sandbox
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix segv

Browse Source
This commit is contained in:
guochao 2023-11-03 11:30:49 +08:00
parent d422f30774
commit 0eb915ebeb
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/main.rs
View File

@ -68,7 +68,7 @@ fn main() -> anyhow::Result<()> {
return Err(err.into()); return Err(err.into());
} }
}; };
nix::sys::ptrace::setoptions(child, Options::PTRACE_O_TRACESECCOMP)?; nix::sys::ptrace::setoptions(child, Options::PTRACE_O_TRACESECCOMP | Options::PTRACE_O_TRACECLONE | Options::PTRACE_O_TRACEFORK | Options::PTRACE_O_TRACEVFORK)?;
nix::sys::ptrace::cont(child, None)?; nix::sys::ptrace::cont(child, None)?;
log::trace!("child is ready"); log::trace!("child is ready");
@ -158,8 +158,13 @@ fn main() -> anyhow::Result<()> {
log::trace!("accepting {}({})", syscall_name, syscall_nr); log::trace!("accepting {}({})", syscall_name, syscall_nr);
}; };
log::debug!("restrict myself by set_no_new_privs..."); #[cfg(feature = "tracing-mode")]
nix::sys::prctl::set_no_new_privs()?; if tracing {
log::debug!("no need to restrict myself by set_no_new_privs");
} else {
log::debug!("restrict myself by set_no_new_privs...");
nix::sys::prctl::set_no_new_privs()?;
}
log::info!("loading filter into kernel..."); log::info!("loading filter into kernel...");
if let Err(err) = filter.load() { if let Err(err) = filter.load() {