@@ -10,15 +10,14 @@ This is necessary for sqlite SQLITE_ENABLE_BATCH_ATOMIC_WRITE.
1010+ #include <sys/ioctl.h>
1111 #include <fcntl.h>
1212
13- #include <seccomp.h>
14- @@ -246,6 +247,10 @@ tracker_seccomp_init (void)
15- SCMP_CMP(0, SCMP_CMP_EQ, 2)) < 0)
16- goto out;
13+ #if defined(__linux__) && defined(__x86_64__)
14+ @@ -299,6 +300,8 @@ tracker_seccomp_init (gboolean readonly)
15+ CUSTOM_RULE (ioctl, SCMP_ACT_ALLOW, SCMP_CMP(1, SCMP_CMP_EQ, BTRFS_IOC_GET_SUBVOL_INFO));
16+ #endif
17+ CUSTOM_RULE (ioctl, SCMP_ACT_ALLOW, SCMP_CMP(1, SCMP_CMP_EQ, FS_IOC_GETFSUUID));
18+ +
19+ + CUSTOM_RULE (ioctl, SCMP_ACT_ERRNO (EACCES), SCMP_CMP(1, SCMP_CMP_EQ, _IOR(0xf5, 12, __u32)));
1720
18- + if (seccomp_rule_add (ctx, SCMP_ACT_ERRNO (EACCES), SCMP_SYS(ioctl), 1,
19- + SCMP_CMP(1, SCMP_CMP_EQ, _IOR(0xf5, 12, __u32))) < 0)
20- + goto out;
21- +
22- /* Special requirements for open/openat, allow O_RDONLY calls,
23- * but fail if write permissions are requested.
24- */
21+ if (readonly) {
22+ /* Special requirements for open/openat, allow O_RDONLY calls,
23+
0 commit comments