portable: add SystemCallFilter=@System-service to the three main port…

…able service profiles … but leave the "trusted" profile unmodified, it shall have full access to all system calls, as before.
V000V · Jun 14, 2018 · 6f659e5 · 6f659e5
1 parent ee8f261
commit 6f659e5
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 0 deletions.
diff --git a/src/portable/profile/default/service.conf b/src/portable/profile/default/service.conf
@@ -27,4 +27,6 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 RestrictRealtime=yes
 RestrictNamespaces=yes
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
 SystemCallArchitectures=native
diff --git a/src/portable/profile/nonetwork/service.conf b/src/portable/profile/nonetwork/service.conf
@@ -25,6 +25,8 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 RestrictRealtime=yes
 RestrictNamespaces=yes
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
 SystemCallArchitectures=native
 PrivateNetwork=yes
 IPAddressDeny=any
diff --git a/src/portable/profile/strict/service.conf b/src/portable/profile/strict/service.conf
@@ -23,6 +23,8 @@ NoNewPrivileges=yes
 MemoryDenyWriteExecute=yes
 RestrictRealtime=yes
 RestrictNamespaces=yes
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
 SystemCallArchitectures=native
 PrivateNetwork=yes
 IPAddressDeny=any