Add a basic seccomp2 syscall filter on Linux

It's controlled by the new Sandbox argument.  Right now, it's rather
coarse-grained, it's Linux-only, and it may break some features.

1 files changed, 16 insertions, 0 deletions

diff --git a/src/common/log.c b/src/common/log.c
index e196a1128..6f95e518c 100644
--- a/src/common/log.c
+++ b/src/common/log.c
@@ -1138,6 +1138,22 @@ get_min_log_level(void)
   return min;
 }
 
+/** Return the fd of a file log that is receiving ERR messages, or -1 if
+ * no such log exists. */
+int
+get_err_logging_fd(void)
+{
+  const logfile_t *lf;
+  for (lf = logfiles; lf; lf = lf->next) {
+    if (lf->is_temporary || lf->is_syslog || !lf->filename ||
+        lf->callback || lf->seems_dead || lf->fd < 0)
+      continue;
+    if (lf->severities->masks[LOG_ERR] & LD_GENERAL)
+      return lf->fd;
+  }
+  return -1;
+}
+
 /** Switch all logs to output at most verbose level. */
 void
 switch_logs_debug(void)