diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index 625063f1c0..edc070f6ea 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -1461,6 +1461,10 @@ CapabilityBoundingSet=~CAP_B CAP_C
@cpu-emulation
System calls for CPU emulation functionality (vm862 and related calls)
+
+ @credentials
+ System calls for querying process credentials (getuid2, capget2, and related calls)
+
@debug
Debugging, performance monitoring and tracing functionality (ptrace2, perf_event_open2 and related calls)
@@ -1481,6 +1485,10 @@ CapabilityBoundingSet=~CAP_B CAP_C
@keyring
Kernel keyring access (keyctl2 and related calls)
+
+ @memlock
+ Locking of memory into RAM (mlock2, mlockall2 and related calls)
+
@module
Loading and unloading of kernel modules (init_module2, delete_module2 and related calls)
@@ -1521,10 +1529,18 @@ CapabilityBoundingSet=~CAP_B CAP_C
@setuid
System calls for changing user ID and group ID credentials, (setuid2, setgid2, setresuid2, …)
+
+ @signal
+ System calls for manipulating and handling process signals (signal2, sigprocmask2, …)
+
@swap
System calls for enabling/disabling swap devices (swapon2, swapoff2)
+
+ @timer
+ System calls for scheduling operations by time (alarm2, timer_create2, …)
+
diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index f4f4eb36d3..e282469155 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -333,6 +333,32 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
"vm86\0"
"vm86old\0"
},
+ [SYSCALL_FILTER_SET_CREDENTIALS] = {
+ .name = "@credentials",
+ .help = "Query own process credentials",
+ .value =
+ "capget\0"
+ "getegid\0"
+ "getegid32\0"
+ "geteuid\0"
+ "geteuid32\0"
+ "getgid\0"
+ "getgid32\0"
+ "getgroups\0"
+ "getgroups32\0"
+ "getpgid\0"
+ "getpgrp\0"
+ "getpid\0"
+ "getppid\0"
+ "getresgid\0"
+ "getresgid32\0"
+ "getresuid\0"
+ "getresuid32\0"
+ "getsid\0"
+ "gettid\0"
+ "getuid\0"
+ "getuid32\0"
+ },
[SYSCALL_FILTER_SET_DEBUG] = {
.name = "@debug",
.help = "Debugging, performance monitoring and tracing functionality",
@@ -487,6 +513,16 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
"keyctl\0"
"request_key\0"
},
+ [SYSCALL_FILTER_SET_MEMLOCK] = {
+ .name = "@memlock",
+ .help = "Memory locking control",
+ .value =
+ "mlock\0"
+ "mlock2\0"
+ "mlockall\0"
+ "munlock\0"
+ "munlockall\0"
+ },
[SYSCALL_FILTER_SET_MODULE] = {
.name = "@module",
.help = "Loading and unloading of kernel modules",
@@ -691,6 +727,24 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
"setuid\0"
"setuid32\0"
},
+ [SYSCALL_FILTER_SET_SIGNAL] = {
+ .name = "@signal",
+ .help = "Process signal handling",
+ .value =
+ "rt_sigaction\0"
+ "rt_sigpending\0"
+ "rt_sigprocmask\0"
+ "rt_sigsuspend\0"
+ "rt_sigtimedwait\0"
+ "sigaction\0"
+ "sigaltstack\0"
+ "signal\0"
+ "signalfd\0"
+ "signalfd4\0"
+ "sigpending\0"
+ "sigprocmask\0"
+ "sigsuspend\0"
+ },
[SYSCALL_FILTER_SET_SWAP] = {
.name = "@swap",
.help = "Enable/disable swap devices",
@@ -698,6 +752,23 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
"swapoff\0"
"swapon\0"
},
+ [SYSCALL_FILTER_SET_TIMER] = {
+ .name = "@timer",
+ .help = "Schedule operations by time",
+ .value =
+ "alarm\0"
+ "getitimer\0"
+ "setitimer\0"
+ "timer_create\0"
+ "timer_delete\0"
+ "timer_getoverrun\0"
+ "timer_gettime\0"
+ "timer_settime\0"
+ "timerfd_create\0"
+ "timerfd_gettime\0"
+ "timerfd_settime\0"
+ "times\0"
+ },
};
const SyscallFilterSet *syscall_filter_set_find(const char *name) {
diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h
index c1612f5894..d4ff027df8 100644
--- a/src/shared/seccomp-util.h
+++ b/src/shared/seccomp-util.h
@@ -44,11 +44,13 @@ enum {
SYSCALL_FILTER_SET_BASIC_IO,
SYSCALL_FILTER_SET_CLOCK,
SYSCALL_FILTER_SET_CPU_EMULATION,
+ SYSCALL_FILTER_SET_CREDENTIALS,
SYSCALL_FILTER_SET_DEBUG,
SYSCALL_FILTER_SET_FILE_SYSTEM,
SYSCALL_FILTER_SET_IO_EVENT,
SYSCALL_FILTER_SET_IPC,
SYSCALL_FILTER_SET_KEYRING,
+ SYSCALL_FILTER_SET_MEMLOCK,
SYSCALL_FILTER_SET_MODULE,
SYSCALL_FILTER_SET_MOUNT,
SYSCALL_FILTER_SET_NETWORK_IO,
@@ -59,7 +61,9 @@ enum {
SYSCALL_FILTER_SET_REBOOT,
SYSCALL_FILTER_SET_RESOURCES,
SYSCALL_FILTER_SET_SETUID,
+ SYSCALL_FILTER_SET_SIGNAL,
SYSCALL_FILTER_SET_SWAP,
+ SYSCALL_FILTER_SET_TIMER,
_SYSCALL_FILTER_SET_MAX
};