changeset 5230:92569921a974 draft

Linux: Lock the BPF filter from future changes
author Roy Marples <roy@marples.name>
date Sat, 16 May 2020 12:28:56 +0100
parents bb468c1a3b46
children a2c342295221
files src/if-linux.c
diffstat 1 files changed, 11 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/src/if-linux.c	Fri May 15 22:29:30 2020 +0100
+++ b/src/if-linux.c	Sat May 16 12:28:56 2020 +0100
@@ -1725,7 +1725,17 @@
 	};
 
 	/* Install the filter. */
-	return setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER, &pf, sizeof(pf));
+	if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER, &pf, sizeof(pf)) == -1)
+		return -1;
+
+#ifdef SO_LOCK_FILTER
+	int on = 1;
+
+	if (setsockopt(s, SOL_SOCKET, SO_LOCK_FILTER, &on, sizeof(on)) == -1)
+		return -1;
+#endif
+
+	return 0;
 }
 
 int