Author: blogic Date: 2015-03-26 11:58:44 +0100 (Thu, 26 Mar 2015) New Revision: 45012
Added: trunk/package/network/services/mdns/files/mdns.json Modified: trunk/package/network/services/mdns/Makefile trunk/package/network/services/mdns/files/mdns.config trunk/package/network/services/mdns/files/mdns.init Log: mdns: add jail and seccomp support Signed-off-by: John Crispin <[email protected]> Modified: trunk/package/network/services/mdns/Makefile =================================================================== --- trunk/package/network/services/mdns/Makefile 2015-03-26 10:58:30 UTC (rev 45011) +++ trunk/package/network/services/mdns/Makefile 2015-03-26 10:58:44 UTC (rev 45012) @@ -20,6 +20,7 @@ PKG_MAINTAINER:=John Crispin <[email protected]> PKG_LICENSE:=LGPL-2.1 +include $(INCLUDE_DIR)/package-seccomp.mk include $(INCLUDE_DIR)/package.mk include $(INCLUDE_DIR)/cmake.mk @@ -37,6 +38,7 @@ $(INSTALL_BIN) $(PKG_BUILD_DIR)/mdns $(1)/usr/sbin/ $(INSTALL_BIN) ./files/mdns.init $(1)/etc/init.d/mdns $(INSTALL_CONF) ./files/mdns.config $(1)/etc/config/mdns + $(call InstallSeccomp,$(1),./files/mdns.json) endef $(eval $(call BuildPackage,mdns)) Modified: trunk/package/network/services/mdns/files/mdns.config =================================================================== --- trunk/package/network/services/mdns/files/mdns.config 2015-03-26 10:58:30 UTC (rev 45011) +++ trunk/package/network/services/mdns/files/mdns.config 2015-03-26 10:58:44 UTC (rev 45012) @@ -1,2 +1,3 @@ config mdns + option jail 1 list network lan Modified: trunk/package/network/services/mdns/files/mdns.init =================================================================== --- trunk/package/network/services/mdns/files/mdns.init 2015-03-26 10:58:30 UTC (rev 45011) +++ trunk/package/network/services/mdns/files/mdns.init 2015-03-26 10:58:44 UTC (rev 45012) @@ -35,6 +35,7 @@ procd_open_instance procd_set_param command "$PROG" + procd_set_param seccomp /etc/seccomp/mdns.json procd_set_param respawn procd_open_trigger procd_add_config_trigger "config.change" "mdns" /etc/init.d/mdns reload @@ -43,10 +44,11 @@ done procd_add_raw_trigger "instance.update" 5000 "/bin/ubus" "call" "mdns" "reload" procd_close_trigger + [ "$(uci get mdns.@mdns[-1].jail)" = 1 ] && procd_add_jail mdns ubus log procd_close_instance } service_started() { - ubus wait_for -t 5 mdns + ubus wait_for -t 10 mdns [ $? = 0 ] && reload_service } Added: trunk/package/network/services/mdns/files/mdns.json =================================================================== --- trunk/package/network/services/mdns/files/mdns.json (rev 0) +++ trunk/package/network/services/mdns/files/mdns.json 2015-03-26 10:58:44 UTC (rev 45012) @@ -0,0 +1,32 @@ +{ + "whitelist": [ + "read", + "write", + "open", + "close", + "time", + "brk", + "ioctl", + "uname", + "bind", + "connect", + "getsockname", + "recvmsg", + "sendmsg", + "sendto", + "setsockopt", + "socket", + "poll", + "fcntl64", + "epoll_create", + "epoll_ctl", + "epoll_wait", + "rt_sigaction", + "sigreturn", + "rt_sigreturn", + "exit_group", + "exit", + "clock_gettime" + ], + "policy": 1 +} _______________________________________________ openwrt-commits mailing list [email protected] https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-commits
