[ptxdist] [PATCH 2/2] systemd: add option for seccomp support

[Clemens Gruber <clemens.gruber@pqgruber.com>]

With seccomp support enabled, service files can limit the syscalls a
process is allowed to use through the SystemCallFilter option.

Signed-off-by: Clemens Gruber <clemens.gruber@pqgruber.com>
---
 rules/systemd.in   | 8 ++++++++
 rules/systemd.make | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/rules/systemd.in b/rules/systemd.in
index 979e32c..c58e424 100644
--- a/rules/systemd.in
+++ b/rules/systemd.in
@@ -17,6 +17,7 @@ menuconfig SYSTEMD
 	select MACHINE_ID	if RUNTIME
 	select XZ		if SYSTEMD_XZ
 	select LZ4		if SYSTEMD_LZ4
+	select LIBSECCOMP	if SYSTEMD_SECCOMP
 	select LIBSELINUX	if GLOBAL_SELINUX
 	# for udev:
 	select ROOTFS_DEV
@@ -94,5 +95,12 @@ config SYSTEMD_COREDUMP
 	help
 	  Enable this only if you need to debug a crashing systemd service
 
+config SYSTEMD_SECCOMP
+	bool
+	prompt "enable seccomp filtering support"
+	help
+	  Enable this if you want to use SystemCallFilter in service files
+
+
 endif
 
diff --git a/rules/systemd.make b/rules/systemd.make
index b2edb3d..5c87023 100644
--- a/rules/systemd.make
+++ b/rules/systemd.make
@@ -73,7 +73,7 @@ SYSTEMD_CONF_OPT	:= \
 	--enable-kmod \
 	--disable-xkbcommon \
 	--enable-blkid \
-	--disable-seccomp \
+	--$(call ptx/endis,PTXCONF_SYSTEMD_SECCOMP)-seccomp \
 	--disable-ima \
 	$(GLOBAL_SELINUX_OPTION) \
 	--disable-apparmor \
-- 
2.7.1


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de