clatd: implement seccomp system call protection
but only enable it in enforcing mode on aarch64,
since that gets good test coverage via Pixel
on GoogleGuest ipv6-only wifi network
and (for example) T-Mobile US cellular.
For other architectures this will only result
in (automatically ratelimitted to at most 5/s)
audit logs for any 'unusual' system calls.
Test: TreeHugger, manually on Pixel on GoogleGuest wifi
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id14c6d9db8d7b4652c7358cac101a82ef09843e0
diff --git a/clatd/clatd.h b/clatd/clatd.h
index daa5ebc..11e9687 100644
--- a/clatd/clatd.h
+++ b/clatd/clatd.h
@@ -48,7 +48,7 @@
// plus some extra just-in-case headroom, because it doesn't hurt.
#define MAXDUMPLEN (64 + MAXMTU)
-#define CLATD_VERSION "1.7"
+#define CLATD_VERSION "1.8"
#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))