On Tue, Jun 02, 2020 at 02:44:31PM +0200, Lennart Poettering wrote: > We have that actually, it's this line you pasted above: > > SystemCallArchitectures=native > > It means: block all syscall ABIs but the native one for all processes > of this service. Gotcha. And I see this now as I'm working on the code to generating bitmaps automatically. After systemd-resolved applies the 26th filter, the "compat" bitmap goes from effectively a duplicate of the native syscall map to blocking everything. after filter 25: ... [ 5.405296] seccomp: syscall bitmap: compat 0-4: SECCOMP_RET_ALLOW [ 5.405297] seccomp: syscall bitmap: compat 5: filter ... [ 5.405326] seccomp: syscall bitmap: compat 380: filter [ 5.405327] seccomp: syscall bitmap: compat 381-439: SECCOMP_RET_ALLOW after filter 26: ... [ 5.405498] seccomp: syscall bitmap: compat 0-439: SECCOMP_RET_KILL_THREAD So that seems to be working as expected. :) -- Kees Cook
