snxrzx
/
mkxp-sunshine
mirror of https://forgejo.xatacraft.ru/Sunshine/mkxp-sunshine.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SECCOMP syscalls blacklist extended

This commit is contained in:
DepressedTWM 2026-06-05 15:38:05 -04:00
parent 8526adff06
commit d978fae6cf
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/security.cpp
View File

@ -4,15 +4,24 @@
#include "debugwriter.h" #include "debugwriter.h"
#include <stdio.h> #include <stdio.h>
// In the future, we plan to add a mod loader, so this component is needed to protect users from mod attacks.
#ifdef __linux__ #ifdef __linux__
#include <seccomp.h> #include <seccomp.h>
//shitty shit //Yes its not best way, anyway better than nothing.
scmp_filter_ctx ctx; scmp_filter_ctx ctx;
int seccomplist[] = {SCMP_SYS(bpf), SCMP_SYS(set_mempolicy), SCMP_SYS(set_mempolicy_home_node), SCMP_SYS(vhangup), SCMP_SYS(settimeofday), SCMP_SYS(stime), SCMP_SYS(clock_settime), SCMP_SYS(clock_settime64), SCMP_SYS(iopl), SCMP_SYS(ioperm), SCMP_SYS(ptrace), SCMP_SYS(process_vm_writev), SCMP_SYS(process_vm_readv), SCMP_SYS(process_madvise), SCMP_SYS(pidfd_getfd), SCMP_SYS(kcmp), SCMP_SYS(delete_module), SCMP_SYS(init_module), SCMP_SYS(init_module), SCMP_SYS(chroot), SCMP_SYS(reboot), SCMP_SYS(unshare), SCMP_SYS(umount2), SCMP_SYS(umount), SCMP_SYS(setns), SCMP_SYS(sethostname), SCMP_SYS(setdomainname), SCMP_SYS(bpf), SCMP_SYS(quotactl_fd), SCMP_SYS(quotactl), SCMP_SYS(move_mount), SCMP_SYS(mount_setattr), SCMP_SYS(mount), SCMP_SYS(lsm_set_self_attr), SCMP_SYS(lsm_list_modules), SCMP_SYS(lsm_get_self_attr), SCMP_SYS(process_vm_readv), SCMP_SYS(process_vm_writev), SCMP_SYS(ptrace)}; int seccomplist[] = {SCMP_SYS(bpf), SCMP_SYS(set_mempolicy), SCMP_SYS(set_mempolicy_home_node), SCMP_SYS(vhangup), SCMP_SYS(settimeofday), SCMP_SYS(stime), SCMP_SYS(clock_settime),
SCMP_SYS(clock_settime64), SCMP_SYS(iopl), SCMP_SYS(ioperm), SCMP_SYS(ptrace), SCMP_SYS(process_vm_writev), SCMP_SYS(process_vm_readv), SCMP_SYS(process_madvise),
SCMP_SYS(pidfd_getfd), SCMP_SYS(kcmp), SCMP_SYS(delete_module), SCMP_SYS(init_module), SCMP_SYS(init_module), SCMP_SYS(chroot), SCMP_SYS(reboot), SCMP_SYS(unshare),
SCMP_SYS(umount2), SCMP_SYS(umount), SCMP_SYS(setns), SCMP_SYS(sethostname), SCMP_SYS(setdomainname), SCMP_SYS(bpf), SCMP_SYS(quotactl_fd), SCMP_SYS(quotactl),
SCMP_SYS(move_mount), SCMP_SYS(mount_setattr), SCMP_SYS(mount), SCMP_SYS(lsm_set_self_attr), SCMP_SYS(lsm_list_modules), SCMP_SYS(lsm_get_self_attr),
SCMP_SYS(process_vm_readv), SCMP_SYS(process_vm_writev), SCMP_SYS(ptrace), SCMP_SYS(swapon), SCMP_SYS(swapoff), SCMP_SYS(shutdown), SCMP_SYS(settimeofday),
SCMP_SYS(sethostname), SCMP_SYS(umount), SCMP_SYS(umount2), SCMP_SYS(vm86old), SCMP_SYS(vm86), SCMP_SYS(setgroups), SCMP_SYS(setgid), SCMP_SYS(setfsuid),
SCMP_SYS(setfsgid), SCMP_SYS(setdomainname), SCMP_SYS(setns), SCMP_SYS(setpgid), SCMP_SYS(pciconfig_write), SCMP_SYS(shutdown), SCMP_SYS(shutdown)};
#endif #endif
void SecurityManagerInit(){ void SecurityManagerInit(){
Debug() << "Initializing SecurityEngine"; Debug() << "[SECURITY] Initializing SecurityEngine";
#ifdef __linux__ #ifdef __linux__
printf("[SECURITY] initializing SECCOMP filter...\n"); printf("[SECURITY] initializing SECCOMP filter...\n");
ctx = seccomp_init(SCMP_ACT_ALLOW); // Default action: Kill the process ctx = seccomp_init(SCMP_ACT_ALLOW); // Default action: Kill the process
@ -31,6 +40,8 @@ void SecurityManagerInit(){
seccomp_release(ctx); seccomp_release(ctx);
} }
} }
#elif
Debug() << "[SECURITY] SecurityManager doesn't support this platform.";
#endif #endif
} }