GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-20 05:31:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

seccomp: Refactor the filter callback and the API

Browse source 
The reason I did this is to add a seccomp API that will be usable
for an x86 fast path.  The x86 entry code needs to use a rather
expensive slow path for a syscall that might be visible to things
like ptrace.  By splitting seccomp into two phases, we can check
whether we need the slow path and then use the fast path in if the
filter allows the syscall or just returns some errno.

As a side effect, I think the new code is much easier to understand
than the old code.

This has one user-visible effect: the audit record written for
SECCOMP_RET_TRACE is now a simple indication that SECCOMP_RET_TRACE
happened.  It used to depend in a complicated way on what the tracer
did.  I couldn't make much sense of it.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Kees Cook <keescook@chromium.org>
This commit is contained in:
Andy Lutomirski 2014-07-21 18:49:15 -07:00 • committed by Kees Cook
parent a4412fc948
commit 13aa72f0fd
2 changed files with 130 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

6
include/linux/seccomp.h
View file

@ -35,6 +35,12 @@ static inline int secure_computing(void)
return __secure_computing();
return 0;
}
#define SECCOMP_PHASE1_OK 0
#define SECCOMP_PHASE1_SKIP 1
extern u32 seccomp_phase1(void);
int seccomp_phase2(u32 phase1_result);
#else
extern void secure_computing_strict(int this_syscall);
#endif