From 32bcbd73e0988d2d2237690ffae33b4f5cc5ff81 Mon Sep 17 00:00:00 2001
From: Julian Andres Klode <jak@debian.org>
Date: Sun, 22 Oct 2017 23:34:03 +0200
Subject: Sandbox methods with seccomp-BPF; except cdrom, gpgv, rsh

This reduces the number of syscalls to about 140 from about
350 or so, significantly reducing security risks.

Also change prepare-release to ignore the architecture lists
in the build dependencies when generating the build-depends
package for travis.

We might want to clean up things a bit more and/or move it
somewhere else.
---
 methods/http.cc | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'methods/http.cc')

diff --git a/methods/http.cc b/methods/http.cc
index cbc77f477..d939ba7b1 100644
--- a/methods/http.cc
+++ b/methods/http.cc
@@ -984,6 +984,8 @@ BaseHttpMethod::DealWithHeadersResult HttpMethod::DealWithHeaders(FetchResult &R
 									/*}}}*/
 HttpMethod::HttpMethod(std::string &&pProg) : BaseHttpMethod(pProg.c_str(), "1.2", Pipeline | SendConfig)/*{{{*/
 {
+   SeccompFlags = aptMethod::BASE | aptMethod::NETWORK;
+
    auto addName = std::inserter(methodNames, methodNames.begin());
    if (Binary != "http")
       addName = "http";
-- 
cgit v1.2.3