Commit 48dc92b9 authored by Kees Cook's avatar Kees Cook
Browse files

seccomp: add "seccomp" syscall 



This adds the new "seccomp" syscall with both an "operation" and "flags"
parameter for future expansion. The third argument is a pointer value,
used with the SECCOMP_SET_MODE_FILTER operation. Currently, flags must
be 0. This is functionally equivalent to prctl(PR_SET_SECCOMP, ...).

In addition to the TSYNC flag later in this patch series, there is a
non-zero chance that this syscall could be used for configuring a fixed
argument area for seccomp-tracer-aware processes to pass syscall arguments
in the future. Hence, the use of "seccomp" not simply "seccomp_add_filter"
for this syscall. Additionally, this syscall uses operation, flags,
and user pointer for arguments because strictly passing arguments via
a user pointer would mean seccomp itself would be unable to trivially
filter the seccomp syscall itself.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarOleg Nesterov <oleg@redhat.com>
Reviewed-by: default avatarAndy Lutomirski <luto@amacapital.net>
parent 3b23dd12

arch/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -321,6 +321,7 @@ config HAVE_ARCH_SECCOMP_FILTER 
	  - secure_computing is called from a ptrace_event()-safe context

	  - secure_computing return value is checked and a return value of -1

	    results in the system call being skipped immediately.

	  - seccomp syscall wired up



config SECCOMP_FILTER

	def_bool y

arch/x86/syscalls/syscall_32.tbl

+1 −0
Original line number Diff line number Diff line
@@ -360,3 +360,4 @@ 
351	i386	sched_setattr		sys_sched_setattr

352	i386	sched_getattr		sys_sched_getattr

353	i386	renameat2		sys_renameat2

354	i386	seccomp			sys_seccomp

arch/x86/syscalls/syscall_64.tbl

+1 −0
Original line number Diff line number Diff line
@@ -323,6 +323,7 @@ 
314	common	sched_setattr		sys_sched_setattr

315	common	sched_getattr		sys_sched_getattr

316	common	renameat2		sys_renameat2

317	common	seccomp			sys_seccomp



#

# x32-specific system call numbers start at 512 to avoid cache impact

include/linux/syscalls.h

+2 −0
Original line number Diff line number Diff line
@@ -866,4 +866,6 @@ asmlinkage long sys_process_vm_writev(pid_t pid, 
asmlinkage long sys_kcmp(pid_t pid1, pid_t pid2, int type,

			 unsigned long idx1, unsigned long idx2);

asmlinkage long sys_finit_module(int fd, const char __user *uargs, int flags);

asmlinkage long sys_seccomp(unsigned int op, unsigned int flags,

			    const char __user *uargs);

#endif

include/uapi/asm-generic/unistd.h

+3 −1
Original line number Diff line number Diff line
@@ -699,9 +699,11 @@ __SYSCALL(__NR_sched_setattr, sys_sched_setattr) 
__SYSCALL(__NR_sched_getattr, sys_sched_getattr)

#define __NR_renameat2 276

__SYSCALL(__NR_renameat2, sys_renameat2)

#define __NR_seccomp 277

__SYSCALL(__NR_seccomp, sys_seccomp)



#undef __NR_syscalls

#define __NR_syscalls 277

#define __NR_syscalls 278



/*

 * All syscalls below here should go away really,

CRA Git | Maintained and supported by SUSTech CRA and CCSE