executor: don't checkpoint/reset net namespace with setuid sandbox

After setuid the process won't have rights to reset net namespace,
but it should not be able to change it during fuzzing too.
So just skip that part.

1 files changed, 8 insertions, 0 deletions

diff --git a/pkg/csource/generated.go b/pkg/csource/generated.go
index ee719dc65..f25ee1998 100644
--- a/pkg/csource/generated.go
+++ b/pkg/csource/generated.go
@@ -2862,6 +2862,10 @@ static void reset_ebtables()
 
 static void checkpoint_net_namespace(void)
 {
+#if SYZ_EXECUTOR
+	if (flag_sandbox == sandbox_setuid)
+		return;
+#endif
 	checkpoint_ebtables();
 	checkpoint_arptables();
 	checkpoint_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]), AF_INET, SOL_IP);
@@ -2870,6 +2874,10 @@ static void checkpoint_net_namespace(void)
 
 static void reset_net_namespace(void)
 {
+#if SYZ_EXECUTOR
+	if (flag_sandbox == sandbox_setuid)
+		return;
+#endif
 	reset_ebtables();
 	reset_arptables();
 	reset_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]), AF_INET, SOL_IP);