@@ -71,13 +71,13 @@ bool setupSeccompWhitelist(void)
7171 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (mmap ), 0 );
7272 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (munmap ), 0 );
7373 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (mprotect ), 1 ,
74- SCMP_A2 (SCMP_CMP_EQ , PROT_NONE ));
74+ SCMP_A2 (SCMP_CMP_EQ , PROT_NONE ));
7575 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (mprotect ), 1 ,
76- SCMP_A2 (SCMP_CMP_EQ , PROT_READ ));
76+ SCMP_A2 (SCMP_CMP_EQ , PROT_READ ));
7777 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (mprotect ), 1 ,
78- SCMP_A2 (SCMP_CMP_EQ , PROT_WRITE ));
78+ SCMP_A2 (SCMP_CMP_EQ , PROT_WRITE ));
7979 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (mprotect ), 1 ,
80- SCMP_A2 (SCMP_CMP_EQ , PROT_READ |PROT_WRITE ));
80+ SCMP_A2 (SCMP_CMP_EQ , PROT_READ |PROT_WRITE ));
8181 /* clock */
8282 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (clock_gettime ), 0 );
8383 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (clock_getres ), 0 );
@@ -99,22 +99,22 @@ bool setupSeccompWhitelist(void)
9999 * getrlimit(RLIMIT_NOFILE, {rlim_cur=1024, rlim_max=4*1024}) = 0
100100 */
101101 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (getrlimit ), 1 ,
102- SCMP_A0 (SCMP_CMP_EQ , RLIMIT_NOFILE ));
102+ SCMP_A0 (SCMP_CMP_EQ , RLIMIT_NOFILE ));
103103 /* pipes, eventfd */
104104 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (pipe ), 0 );
105105 /* STRACE:
106106 * eventfd2(0, 0)
107107 */
108108 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (eventfd2 ), 2 ,
109- SCMP_A0 (SCMP_CMP_EQ , 0 ),
110- SCMP_A1 (SCMP_CMP_EQ , 0 ));
109+ SCMP_A0 (SCMP_CMP_EQ , 0 ),
110+ SCMP_A1 (SCMP_CMP_EQ , 0 ));
111111 /* socket */
112112 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (socket ), 1 ,
113- SCMP_A0 (SCMP_CMP_EQ , PF_LOCAL ),
114- SCMP_A1 (SCMP_CMP_MASKED_EQ , SOCK_STREAM , SOCK_STREAM ));
113+ SCMP_A0 (SCMP_CMP_EQ , PF_LOCAL ),
114+ SCMP_A1 (SCMP_CMP_MASKED_EQ , SOCK_STREAM , SOCK_STREAM ));
115115 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (socket ), 1 ,
116- SCMP_A0 (SCMP_CMP_EQ , PF_NETLINK ),
117- SCMP_A2 (SCMP_CMP_EQ , NETLINK_KOBJECT_UEVENT ));
116+ SCMP_A0 (SCMP_CMP_EQ , PF_NETLINK ),
117+ SCMP_A2 (SCMP_CMP_EQ , NETLINK_KOBJECT_UEVENT ));
118118 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (bind ), 0 );
119119 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (accept ), 0 );
120120 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (listen ), 0 );
@@ -132,7 +132,7 @@ bool setupSeccompWhitelist(void)
132132 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (capset ), 0 );
133133 /* allow to drop capabilities using prctl */
134134 ret |= seccomp_rule_add (ctx , SCMP_ACT_ALLOW , SCMP_SYS (prctl ), 1 ,
135- SCMP_A0 (SCMP_CMP_EQ , PR_CAPBSET_DROP ));
135+ SCMP_A0 (SCMP_CMP_EQ , PR_CAPBSET_DROP ));
136136#endif /* HAVE_LIBCAPNG */
137137
138138 /* before main() only */
0 commit comments