use signalfd() for signal handling

Makefile.in

@@ -0,0 +1,21 @@
+#! /usr/bin/env make
+
+CC= @CC@
+CFLAGS=@CFLAGS@ -O2 -g -Wall -Wp,-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIE -fPIC
+LDFLAGS=@LDFLAGS@ -fPIC -pie -z relro -z now -fstack-protector
+LDLIBS=@LIBS@
+prefix := /usr/local
+
+all: net2pcap
+
+net2pcap: net2pcap.o
+
+.PHONY: static
+static: net2pcap.$(shell uname -m)
+net2pcap.$(shell uname -m): net2pcap.c
+	$(CC) $(CFLAGS) -static -o $@ $<
+
+
+.PHONY: clean
+clean:
+	rm -f net2pcap.o net2pcap

README

@@ -1,12 +1,11 @@
-
 Net2PCAP is a simple network to pcap capture file for Linux. Its goal
 is to be as simple as possible (hence auditable) so that good
 confidence can be reached, for it to be used in hostile
 environments.
 
-It does not use any library except a bit of libc. It does not do
+It does not require any library except a bit of libc. It does not do
 anything except dumping network traffic from an interface to a pcap
-file. It is less than 400 lines of C. Please audit it !
+file. It is less than 600 lines of C. Please audit it !
 
 Comparison with tcpdump
 
@@ -19,9 +18,10 @@ Comparison with tcpdump
   * net2pcap can reopen its capture file (SIGHUP) (used for capture file rotation)
   * net2pcap does not do anything else than reading from network and dumping to file
   * net2pcap does not use libpcap
+  * net2pcap drops its privileges
+  * net2pcap sandboxes itself (if libseccomp is available)
   * net2pcap runs only on Linux
-  * net2pcap is auditable (less than 400 lines)
+  * net2pcap is auditable (less than 600 lines)
 
 Original code from Philippe Biondi, bugs added by Nicolas Bareil :)
 
-http://www.secdev.org/projects/net2pcap/

autogen.sh

@@ -0,0 +1,4 @@
+#! /bin/sh
+
+autoreconf --install
+automake --add-missing --copy > /dev/null 2>&1

configure.ac

@@ -0,0 +1,25 @@
+AC_INIT([net2pcap], [0.2], [nico@chdir.org], [net2pcap], [http://github.com/nbareil/net2pcap/])
+AC_PREREQ([2.59])
+AC_CONFIG_HEADERS([config.h])
+AC_CONFIG_FILES([Makefile])
+AC_ARG_ENABLE([sandbox],
+              [ --disable-sandbox          do not use SECCOMP sandbox],
+              [sandbox=${enableval}], [sandbox=auto])
+
+have_seccomp=no
+
+if test "x${sandbox}" != xno; then
+    AC_SEARCH_LIBS([seccomp_init], [seccomp], [have_seccomp=yes])
+    AC_CHECK_HEADERS([seccomp.h])
+fi
+
+if test "x${sandbox}" = xyes && test "x${have_seccomp}" != xyes; then
+   AC_MSG_ERROR([
+   --------------------------------------------
+   Unable to find libseccomp. Abording.
+   --------------------------------------------
+   ])
+fi
+
+AC_PROG_CC
+AC_OUTPUT