From ea5ea09244b762008bba509d8c58bad5835fb949 Mon Sep 17 00:00:00 2001 From: Philipp Stephani Date: Sun, 11 Apr 2021 19:42:44 +0200 Subject: [PATCH] Seccomp filter: allow reading the current time (Bug#47708). * lib-src/seccomp-filter.c (main): Allow reading the current time. --- lib-src/seccomp-filter.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lib-src/seccomp-filter.c b/lib-src/seccomp-filter.c index e4d56e01b4d..9d25a5fe142 100644 --- a/lib-src/seccomp-filter.c +++ b/lib-src/seccomp-filter.c @@ -40,6 +40,7 @@ human-readable representation to out.pfc. */ #include #include #include +#include #include #include @@ -286,6 +287,12 @@ main (int argc, char **argv) RULE (SCMP_ACT_ALLOW, SCMP_SYS (sigprocmask)); RULE (SCMP_ACT_ALLOW, SCMP_SYS (rt_sigprocmask)); + /* Allow reading the current time. */ + RULE (SCMP_ACT_ALLOW, SCMP_SYS (clock_gettime), + SCMP_A0_32 (SCMP_CMP_EQ, CLOCK_REALTIME)); + RULE (SCMP_ACT_ALLOW, SCMP_SYS (time)); + RULE (SCMP_ACT_ALLOW, SCMP_SYS (gettimeofday)); + /* Allow timer support. */ RULE (SCMP_ACT_ALLOW, SCMP_SYS (timer_create)); RULE (SCMP_ACT_ALLOW, SCMP_SYS (timerfd_create)); -- 2.39.5