cjdns: add seccomp config flag

Signed-off-by: Lars Gierth <larsg@systemli.org>

diff --git a/cjdns/lua/cjdns/uci.lua b/cjdns/lua/cjdns/uci.lua
index 70c33bc1b98c4d409503f0386a91d31ecab65b81..0127f44109ad38bdbc2dd5eab4f27f4b247b7834 100644 (file)
--- a/cjdns/lua/cjdns/uci.lua
+++ b/cjdns/lua/cjdns/uci.lua
@@ -10,7 +10,14 @@ common.uci = UCI
 -- @return table with configuration defaults
 function UCI.defaults()
   return {
-    security = { { exemptAngel = 1, setuser = "nobody" } },
+    security = {
+      { setuser = "nobody", keepNetAdmin = 1 },
+      { chroot = "/var/run/" },
+      { nofiles = 0 },
+      { noforks = 1 },
+      { seccomp = 0 },
+      { setupComplete = 1 }
+    },
     router = {
         ipTunnel = { outgoingConnections = {}, allowedConnections = {} },
         interface = { type = "TUNInterface" }
@@ -45,6 +52,12 @@ function UCI.get()
     obj.router.interface.tunDevice = config.tun_device
   end
 
+  for i,section in pairs(obj.security) do
+    if type(section.seccomp) == "number" then
+      obj.security[i].seccomp = tonumber(config.seccomp)
+    end
+  end
+
   cursor:foreach("cjdns", "iptunnel_outgoing", function(outgoing)
     table.insert(obj.router.ipTunnel.outgoingConnections, outgoing.public_key)
   end)
@@ -127,7 +140,7 @@ function UCI.set(obj)
     private_key = obj.privateKey,
     admin_password = obj.admin.password,
     admin_address = admin_address,
-    admin_port = admin_port,
+    admin_port = admin_port
   })
 
   if obj.router.interface.tunDevice then
@@ -136,6 +149,18 @@ function UCI.set(obj)
     })
   end
 
+  if obj.security then
+    for i,section in pairs(obj.security) do
+      for key,value in pairs(section) do
+        if key == "seccomp" then
+          UCI.cursor_section(cursor, "cjdns", "cjdns", "cjdns", {
+            seccomp = tonumber(value)
+          })
+        end
+      end
+    end
+  end
+
   if obj.router.ipTunnel.outgoingConnections then
     for i,public_key in pairs(obj.router.ipTunnel.outgoingConnections) do
       UCI.cursor_section(cursor, "cjdns", "iptunnel_outgoing", nil, {