Add seccomp support for sandbox

[ghost]

No description provided.

[mptre]

Great work! Attached is a diff which reworks the macros and some cleanup:

diff --git compat-sandbox.c compat-sandbox.c
index 3f63556..2645f23 100644
--- compat-sandbox.c
+++ compat-sandbox.c
@@ -36,49 +36,45 @@ sandbox(int stage)
 #include <err.h>
 #include <seccomp.h>
 
-#define ALLOW(syscall)								\
-	if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(syscall), 0) < 0) {	\
-		err(1, "seccomp_rule_add");					\
-	}
+#define ALLOW(syscall)							\
+	(seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(syscall), 0) < 0)
 
-#define ALLOW_IOCTL(syscall, x)							\
-	if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ioctl), x,		\
-	    SCMP_A1(SCMP_CMP_EQ, syscall)) < 0) {				\
-		err(1, "seccomp_rule_add (ioctl)");				\
-	}
+#define ALLOW_IOCTL(syscall, x)	\
+	(seccomp_rule_add(ctx, SCMP_ACT_ALLOW,SCMP_SYS(ioctl), x,	\
+	 SCMP_A1(SCMP_CMP_EQ, syscall)) < 0)
 
 void
 sandbox(int stage)
 {
-	scmp_filter_ctx		ctx;
+	scmp_filter_ctx	ctx;
 
 	switch (stage) {
 	case SANDBOX_ENTER:
-
 		if ((ctx = seccomp_init(SCMP_ACT_TRAP)) == NULL)
 			err(1, "seccomp_init");
 
-		ALLOW(access);
-		ALLOW(close);
-		ALLOW(exit_group);
-		ALLOW(fstat);
-		ALLOW(fstat64);
-		ALLOW(mmap);
-		ALLOW(mmap2);
-		ALLOW(munmap);
-		ALLOW(open);
-		ALLOW(poll);
-		ALLOW(read);
-		ALLOW(rt_sigaction);
-		ALLOW(sigaction);
-		ALLOW(sigreturn);
-		ALLOW(stat);
-		ALLOW(stat64);
-		ALLOW(time);
-		ALLOW(write);
-		ALLOW_IOCTL(TCGETS, 1);
-		ALLOW_IOCTL(TCSETS, 1);
-		ALLOW_IOCTL(TIOCGWINSZ, 1);
+		if (ALLOW(access) ||
+		    ALLOW(close) ||
+		    ALLOW(exit_group) ||
+		    ALLOW(fstat) ||
+		    ALLOW(fstat64) ||
+		    ALLOW(mmap) ||
+		    ALLOW(mmap2) ||
+		    ALLOW(munmap) ||
+		    ALLOW(open) ||
+		    ALLOW(poll) ||
+		    ALLOW(read) ||
+		    ALLOW(rt_sigaction) ||
+		    ALLOW(sigaction) ||
+		    ALLOW(sigreturn) ||
+		    ALLOW(stat) ||
+		    ALLOW(stat64) ||
+		    ALLOW(time) ||
+		    ALLOW(write) ||
+		    ALLOW_IOCTL(TCGETS, 1) ||
+		    ALLOW_IOCTL(TCSETS, 1) ||
+		    ALLOW_IOCTL(TIOCGWINSZ, 1))
+			err(1, "seccomp_rule_add");
 
 		if (seccomp_load(ctx) < 0)
 			err(1, "seccomp_load");

[mptre]

I guess libseccomp-dev is required be installed on Travis in order to
trigger the autoconf check? You could try to install it globally in
.travis.yml. Caution, lines below untested:

addons:
  apt:
    packages:
      - libseccomp-dev

[ghost]

Thanks: applied!

[ghost]

The experimental seccomp-support can be enabled with --enable-seccomp ...

[codecov-io]

Codecov Report

Merging #274 into sandbox will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##           sandbox     #274   +/-   ##
========================================
  Coverage    90.58%   90.58%           
========================================
  Files            1        1           
  Lines          510      510           
========================================
  Hits           462      462           
  Misses          48       48

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 321e6e7...9f21d79. Read the comment docs.