revert abstract socket filter

2022-11-26 11:59:44 +01:00 · 2022-11-26 11:59:44 +01:00 · 65ae073550
parent c6f18a5e94
commit 65ae073550
2 changed files with 3 additions and 2 deletions
--- a/exportFilter.c
+++ b/exportFilter.c
@ -110,10 +110,11 @@ int main(int argc, char *argv[])
    DENY_RULE (vmsplice);

    /* filter connect arguments to block communication to abstracte sockets  */
-    if (seccomp_rule_add (ctx, SCMP_ACT_KILL, SCMP_SYS(connect), 1,
+    /* not working and vulnerable to TOUTOC */
+    /* if (seccomp_rule_add (ctx, SCMP_ACT_KILL, SCMP_SYS(connect), 1,
                          SCMP_CMP(1, SCMP_CMP_EQ, '\0')) < 0)
        goto out;
-    
+    */

    /* end of syscall filter list */
    
--- a/seccomp_filter.bpf
+++ b/seccomp_filter.bpf