Allow the dup3() syscall on Linux

I have no idea why, but it seems that dup2() is sometimes implemented internally using the dup3() syscall: #14 (comment) So add that syscall to the allowed list.
eafer · Jan 29, 2021 · f986063 · f986063
1 parent 183029f
commit f986063
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/src/sandbox.c b/src/sandbox.c
@@ -37,6 +37,7 @@ static void do_start_sandbox(void)
 	fail |= seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(writev), 0);
 	fail |= seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(dup), 0);
 	fail |= seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(dup2), 0);
+	fail |= seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(dup3), 0);
 	fail |= seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit), 0);
 	fail |= seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
 	fail |= seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(close), 0);