From d6299d613f916e1d63ef81d6d277d4e98b8e8194 Mon Sep 17 00:00:00 2001 From: Djalal Harouni Date: Mon, 14 Nov 2016 09:12:21 +0100 Subject: [PATCH] core:gperf: pass the exec_context struct directly to parse restrict namespaces The RestrictNamespaces= takes yes, no or a list of namespaces types, therefor config_parse_restrict_namespaces() is a bit complex and it operates on the ExecContext, fix this by passing the offset of ExecContext directly otherwise restricting namespaces won't work. --- src/core/load-fragment-gperf.gperf.m4 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/load-fragment-gperf.gperf.m4 b/src/core/load-fragment-gperf.gperf.m4 index cb2f384..f4ef5a0 100644 --- a/src/core/load-fragment-gperf.gperf.m4 +++ b/src/core/load-fragment-gperf.gperf.m4 @@ -57,7 +57,7 @@ m4_ifdef(`HAVE_SECCOMP', $1.SystemCallArchitectures, config_parse_syscall_archs, 0, offsetof($1, exec_context.syscall_archs) $1.SystemCallErrorNumber, config_parse_syscall_errno, 0, offsetof($1, exec_context) $1.MemoryDenyWriteExecute, config_parse_bool, 0, offsetof($1, exec_context.memory_deny_write_execute) -$1.RestrictNamespaces, config_parse_restrict_namespaces, 0, offsetof($1, exec_context.restrict_namespaces) +$1.RestrictNamespaces, config_parse_restrict_namespaces, 0, offsetof($1, exec_context) $1.RestrictRealtime, config_parse_bool, 0, offsetof($1, exec_context.restrict_realtime) $1.RestrictAddressFamilies, config_parse_address_families, 0, offsetof($1, exec_context)', `$1.SystemCallFilter, config_parse_warn_compat, DISABLED_CONFIGURATION, 0 -- 2.7.4