From e3c4302c3a9735bf46c98f5b34a12d5ce864f49f Mon Sep 17 00:00:00 2001 From: Michal Sojka Date: Tue, 12 Sep 2017 13:12:43 +0200 Subject: [PATCH] Start seccomp-enabled services via seccomp-trace Signed-off-by: Michal Sojka --- service/instance.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/service/instance.c b/service/instance.c index 1760a09..7703686 100644 --- a/service/instance.c +++ b/service/instance.c @@ -303,16 +303,13 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) if (seccomp) setenv("SECCOMP_FILE", in->seccomp, 1); - if ((seccomp || setlbf) && asprintf(&ld_preload, "LD_PRELOAD=%s%s%s", - seccomp ? "/lib/libpreload-seccomp.so" : "", - seccomp && setlbf ? ":" : "", - setlbf ? "/lib/libsetlbf.so" : "") > 0) + if (setlbf && asprintf(&ld_preload, "LD_PRELOAD=/lib/libsetlbf.so") > 0) putenv(ld_preload); blobmsg_list_for_each(&in->limits, var) instance_limits(blobmsg_name(var->data), blobmsg_data(var->data)); - if (in->trace) + if (in->trace || seccomp) argc += 1; argv = alloca(sizeof(char *) * (argc + in->jail.argc)); @@ -320,6 +317,8 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) if (in->trace) argv[argc++] = trace; + else if (seccomp) + argv[argc++] = "/sbin/seccomp-trace"; if (in->has_jail) argc = jail_run(in, argv); -- 2.11.0