@@ -65,39 +65,39 @@ int set_kcron_seccomp(void) {
65
65
/* Basic features */
66
66
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (rt_sigreturn ), 0 ) != 0 ) {
67
67
(void )fprintf (stderr , "%s: Cannot set allowlist 'rt_sigreturn'.\n" , __PROGRAM_NAME );
68
- seccomp_release (ctx );
68
+ ( void ) seccomp_release (ctx );
69
69
exit (EXIT_FAILURE );
70
70
}
71
71
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (brk ), 0 ) != 0 ) {
72
72
(void )fprintf (stderr , "%s: Cannot set allowlist 'brk'.\n" , __PROGRAM_NAME );
73
- seccomp_release (ctx );
73
+ ( void ) seccomp_release (ctx );
74
74
exit (EXIT_FAILURE );
75
75
}
76
76
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (exit ), 0 ) != 0 ) {
77
77
(void )fprintf (stderr , "%s: Cannot set allowlist 'exit'.\n" , __PROGRAM_NAME );
78
- seccomp_release (ctx );
78
+ ( void ) seccomp_release (ctx );
79
79
exit (EXIT_FAILURE );
80
80
}
81
81
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (exit_group ), 0 ) != 0 ) {
82
82
(void )fprintf (stderr , "%s: Cannot set allowlist 'exit_group'.\n" , __PROGRAM_NAME );
83
- seccomp_release (ctx );
83
+ ( void ) seccomp_release (ctx );
84
84
exit (EXIT_FAILURE );
85
85
}
86
86
87
87
/* Permitted actions */
88
88
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (geteuid ), 0 ) != 0 ) {
89
89
(void )fprintf (stderr , "%s: Cannot set allowlist 'geteuid'.\n" , __PROGRAM_NAME );
90
- seccomp_release (ctx );
90
+ ( void ) seccomp_release (ctx );
91
91
exit (EXIT_FAILURE );
92
92
}
93
93
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (getuid ), 0 ) != 0 ) {
94
94
(void )fprintf (stderr , "%s: Cannot set allowlist 'getuid'.\n" , __PROGRAM_NAME );
95
- seccomp_release (ctx );
95
+ ( void ) seccomp_release (ctx );
96
96
exit (EXIT_FAILURE );
97
97
}
98
98
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (getgid ), 0 ) != 0 ) {
99
99
(void )fprintf (stderr , "%s: Cannot set allowlist 'getgid'.\n" , __PROGRAM_NAME );
100
- seccomp_release (ctx );
100
+ ( void ) seccomp_release (ctx );
101
101
exit (EXIT_FAILURE );
102
102
}
103
103
@@ -107,7 +107,7 @@ int set_kcron_seccomp(void) {
107
107
*/
108
108
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (write ), 1 , SCMP_A0 (SCMP_CMP_EQ , 1 )) != 0 ) {
109
109
(void )fprintf (stderr , "%s: Cannot set allowlist 'write' to stdout.\n" , __PROGRAM_NAME );
110
- seccomp_release (ctx );
110
+ ( void ) seccomp_release (ctx );
111
111
exit (EXIT_FAILURE );
112
112
}
113
113
@@ -116,7 +116,7 @@ int set_kcron_seccomp(void) {
116
116
*/
117
117
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (write ), 1 , SCMP_A0 (SCMP_CMP_EQ , 2 )) != 0 ) {
118
118
(void )fprintf (stderr , "%s: Cannot set allowlist 'write' to stderr.\n" , __PROGRAM_NAME );
119
- seccomp_release (ctx );
119
+ ( void ) seccomp_release (ctx );
120
120
exit (EXIT_FAILURE );
121
121
}
122
122
@@ -127,13 +127,13 @@ int set_kcron_seccomp(void) {
127
127
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (openat ), 0 ) != 0 ) {
128
128
/* not sure how to restrict this to the args I want */
129
129
(void )fprintf (stderr , "%s: Cannot set allowlist 'openat'.\n" , __PROGRAM_NAME );
130
- seccomp_release (ctx );
130
+ ( void ) seccomp_release (ctx );
131
131
exit (EXIT_FAILURE );
132
132
}
133
133
134
134
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (close ), 1 , SCMP_A0 (SCMP_CMP_EQ , 3 )) != 0 ) {
135
135
(void )fprintf (stderr , "%s: Cannot set allowlist 'close'.\n" , __PROGRAM_NAME );
136
- seccomp_release (ctx );
136
+ ( void ) seccomp_release (ctx );
137
137
exit (EXIT_FAILURE );
138
138
}
139
139
@@ -142,22 +142,22 @@ int set_kcron_seccomp(void) {
142
142
*/
143
143
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (write ), 1 , SCMP_A0 (SCMP_CMP_EQ , 4 )) != 0 ) {
144
144
(void )fprintf (stderr , "%s: Cannot set allowlist 'write' to our file handle.\n" , __PROGRAM_NAME );
145
- seccomp_release (ctx );
145
+ ( void ) seccomp_release (ctx );
146
146
exit (EXIT_FAILURE );
147
147
}
148
148
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (close ), 1 , SCMP_A0 (SCMP_CMP_EQ , 4 )) != 0 ) {
149
149
(void )fprintf (stderr , "%s: Cannot set allowlist 'close'.\n" , __PROGRAM_NAME );
150
- seccomp_release (ctx );
150
+ ( void ) seccomp_release (ctx );
151
151
exit (EXIT_FAILURE );
152
152
}
153
153
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (fsync ), 1 , SCMP_A0 (SCMP_CMP_EQ , 4 )) != 0 ) {
154
154
(void )fprintf (stderr , "%s: Cannot set allowlist 'fsync' on file handle.\n" , __PROGRAM_NAME );
155
- seccomp_release (ctx );
155
+ ( void ) seccomp_release (ctx );
156
156
exit (EXIT_FAILURE );
157
157
}
158
158
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (fchmod ), 2 , SCMP_A0 (SCMP_CMP_EQ , 4 ), SCMP_A1 (SCMP_CMP_EQ , _0600 )) != 0 ) {
159
159
(void )fprintf (stderr , "%s: Cannot set allowlist 'fchmod' for mode 0600 only.\n" , __PROGRAM_NAME );
160
- seccomp_release (ctx );
160
+ ( void ) seccomp_release (ctx );
161
161
exit (EXIT_FAILURE );
162
162
}
163
163
@@ -166,49 +166,49 @@ int set_kcron_seccomp(void) {
166
166
*/
167
167
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (fstat ), 0 ) != 0 ) {
168
168
(void )fprintf (stderr , "%s: Cannot set allowlist 'fstat'.\n" , __PROGRAM_NAME );
169
- seccomp_release (ctx );
169
+ ( void ) seccomp_release (ctx );
170
170
exit (EXIT_FAILURE );
171
171
}
172
172
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (stat ), 0 ) != 0 ) {
173
173
(void )fprintf (stderr , "%s: Cannot set allowlist 'stat'.\n" , __PROGRAM_NAME );
174
- seccomp_release (ctx );
174
+ ( void ) seccomp_release (ctx );
175
175
exit (EXIT_FAILURE );
176
176
}
177
177
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (newfstatat ), 0 ) != 0 ) {
178
178
(void )fprintf (stderr , "%s: Cannot set allowlist 'newfstatat'.\n" , __PROGRAM_NAME );
179
- seccomp_release (ctx );
179
+ ( void ) seccomp_release (ctx );
180
180
exit (EXIT_FAILURE );
181
181
}
182
182
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (mkdir ), 0 ) != 0 ) {
183
183
(void )fprintf (stderr , "%s: Cannot set allowlist 'mkdir'.\n" , __PROGRAM_NAME );
184
- seccomp_release (ctx );
184
+ ( void ) seccomp_release (ctx );
185
185
exit (EXIT_FAILURE );
186
186
}
187
187
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (fchown ), 0 ) != 0 ) {
188
188
(void )fprintf (stderr , "%s: Cannot set allowlist 'fchown'.\n" , __PROGRAM_NAME );
189
- seccomp_release (ctx );
189
+ ( void ) seccomp_release (ctx );
190
190
exit (EXIT_FAILURE );
191
191
}
192
192
193
193
194
194
#if USE_CAPABILITIES == 1
195
195
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (capget ), 0 ) != 0 ) {
196
196
(void )fprintf (stderr , "%s: Cannot set allowlist 'capget'.\n" , __PROGRAM_NAME );
197
- seccomp_release (ctx );
197
+ ( void ) seccomp_release (ctx );
198
198
exit (EXIT_FAILURE );
199
199
}
200
200
if (seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (capset ), 0 ) != 0 ) {
201
201
(void )fprintf (stderr , "%s: Cannot set allowlist 'capset'.\n" , __PROGRAM_NAME );
202
- seccomp_release (ctx );
202
+ ( void ) seccomp_release (ctx );
203
203
exit (EXIT_FAILURE );
204
204
}
205
205
#endif
206
206
207
207
/* Load rules */
208
- seccomp_load (ctx );
208
+ ( void ) seccomp_load (ctx );
209
209
210
210
/* Release memory */
211
- seccomp_release (ctx );
211
+ ( void ) seccomp_release (ctx );
212
212
213
213
return 0 ;
214
214
}
0 commit comments