diff options
Diffstat (limited to 'src/linux.rs')
| -rw-r--r-- | src/linux.rs | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/src/linux.rs b/src/linux.rs index fc4c63e..bd6ee5c 100644 --- a/src/linux.rs +++ b/src/linux.rs @@ -761,17 +761,16 @@ fn create_fs_device( j.no_new_privs(); - // TODO(chirantan): Enable seccomp // Use TSYNC only for the side effect of it using SECCOMP_RET_TRAP, which will correctly kill // the entire device process if a worker thread commits a seccomp violation. - // let seccomp_policy = cfg.seccomp_policy_dir.join("9p_device.policy"); - // j.set_seccomp_filter_tsync(); - // if cfg.seccomp_log_failures { - // j.log_seccomp_filter_failures(); - // } - // j.parse_seccomp_filters(&seccomp_policy) - // .map_err(Error::DeviceJail)?; - // j.use_seccomp_filter(); + let seccomp_policy = cfg.seccomp_policy_dir.join("fs_device.policy"); + j.set_seccomp_filter_tsync(); + if cfg.seccomp_log_failures { + j.log_seccomp_filter_failures(); + } + j.parse_seccomp_filters(&seccomp_policy) + .map_err(Error::DeviceJail)?; + j.use_seccomp_filter(); // Don't do init setup. j.run_as_init(); |