tree 9f5c4a900665ecc50e45c18bd00d2405c9183a57
parent d2ea8dac705fe9bca9b6b26a7aeb063d1a406f7a
author Daniel P. Berrangé <berrange@redhat.com> 1627561957 +0100
committer Daniel P. Berrangé <berrange@redhat.com> 1645037560 +0000

seccomp: fix blocking of process spawning

When '-sandbox on,spawn=deny' is given, we are supposed to block the
ability to spawn processes. We naively blocked the 'fork' syscall,
forgetting that any modern libc will use the 'clone' syscall instead.

We can't simply block the 'clone' syscall though, as that will break
thread creation. We thus list the set of flags used to create threads
and block anything that doesn't match this exactly.

Acked-by: Eduardo Otubo <otubo@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>