mirrors/cosmopolitan
1
0
Fork 0
mirror of https://github.com/jart/cosmopolitan.git synced 2025-02-08 15:33:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
cosmopolitan/libc/sysv/consts/audit.h

18 lines
814 B
C
Raw Normal View History

Add seccomp bpf sandboxing to redbean It's now possible to pass the `-S` or `-SS` flags to sandbox redbean worker proecsses after they've been forked. The first `-S` flag is intended to be a permissive builtin policy that limits system calls to only that which the various parts of redbean serving need. The second `-SS` flag is intended to be more restrictive, preventing things like the Lua extensions you download off the web from using the HTTP client or sockets APIs. In upcoming changes you'll be able to implement your own Berkeley Packet Filter sandbox programs and load them via Lua.
2022-04-18 15:54:42 +00:00
#ifndef COSMOPOLITAN_LIBC_SYSV_CONSTS_AUDIT_H_
#define COSMOPOLITAN_LIBC_SYSV_CONSTS_AUDIT_H_
#include "libc/elf/def.h"
#define __AUDIT_ARCH_64BIT 0x80000000
#define __AUDIT_ARCH_LE 0x40000000
#define __AUDIT_ARCH_CONVENTION_MASK 0x30000000
#define __AUDIT_ARCH_CONVENTION_MIPS64_N32 0x20000000
Get TEST_LIBC_STR passing on AARCH64 It's now possible to run commands like: make -j8 m=aarch64 o/aarch64/test/libc/str Which will cross-compile and run the test suites in a qemu-aarch64 binary that's vendored in the third_party/qemu/ folder within your x86_64 build environment.
2023-05-13 01:09:23 +00:00
#define AUDIT_ARCH_X86_64 (EM_X86_64 | __AUDIT_ARCH_64BIT | __AUDIT_ARCH_LE)
#define AUDIT_ARCH_I386 (EM_386 | __AUDIT_ARCH_LE)
#define AUDIT_ARCH_AARCH64 (EM_AARCH64 | __AUDIT_ARCH_64BIT | __AUDIT_ARCH_LE)
#define AUDIT_ARCH_PPC64LE (EM_PPC64 | __AUDIT_ARCH_64BIT | __AUDIT_ARCH_LE)
#define AUDIT_ARCH_RISCV64 (EM_RISCV | __AUDIT_ARCH_64BIT | __AUDIT_ARCH_LE)
#define AUDIT_ARCH_S390X (EM_S390 | __AUDIT_ARCH_64BIT)
Add seccomp bpf sandboxing to redbean It's now possible to pass the `-S` or `-SS` flags to sandbox redbean worker proecsses after they've been forked. The first `-S` flag is intended to be a permissive builtin policy that limits system calls to only that which the various parts of redbean serving need. The second `-SS` flag is intended to be more restrictive, preventing things like the Lua extensions you download off the web from using the HTTP client or sockets APIs. In upcoming changes you'll be able to implement your own Berkeley Packet Filter sandbox programs and load them via Lua.
2022-04-18 15:54:42 +00:00
#endif /* COSMOPOLITAN_LIBC_SYSV_CONSTS_AUDIT_H_ */
Reference in a new issue Copy permalink