31
31
struct util_options opts;
33
34
rc = util_getopt(argc, argv, &opts);
37
rc = seccomp_init(SCMP_ACT_KILL);
38
ctx = seccomp_init(SCMP_ACT_KILL);
41
42
/* The next three seccomp_rule_add_exact() calls for read must
42
43
* go together in this order to catch an infinite loop. */
44
rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(read), 1,
45
rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 1,
45
46
SCMP_A0(SCMP_CMP_EQ, STDOUT_FILENO));
49
rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(read), 1,
50
rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 1,
50
51
SCMP_A1(SCMP_CMP_EQ, 0x0));
54
rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(read), 1,
55
rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 1,
55
56
SCMP_A0(SCMP_CMP_EQ, STDIN_FILENO));
59
rc = util_filter_output(&opts);
60
rc = util_filter_output(&opts, ctx);
65
66
return (rc < 0 ? -rc : rc);