diff options
author | Kees Cook <keescook@chromium.org> | 2014-06-25 16:08:24 -0700 |
---|---|---|
committer | Daniel Rosenberg <drosen@google.com> | 2015-01-12 16:49:26 -0800 |
commit | 84ec5f6424fe726e7c0feb51d668d6419c01196f (patch) | |
tree | 4635bb6e77df01baacdab2ddca3e2e87a26874a0 /fs | |
parent | 6b0bed3aeb92456f73412a13b0abfa4104f436c8 (diff) |
seccomp: add "seccomp" syscall
This adds the new "seccomp" syscall with both an "operation" and "flags"
parameter for future expansion. The third argument is a pointer value,
used with the SECCOMP_SET_MODE_FILTER operation. Currently, flags must
be 0. This is functionally equivalent to prctl(PR_SET_SECCOMP, ...).
In addition to the TSYNC flag later in this patch series, there is a
non-zero chance that this syscall could be used for configuring a fixed
argument area for seccomp-tracer-aware processes to pass syscall arguments
in the future. Hence, the use of "seccomp" not simply "seccomp_add_filter"
for this syscall. Additionally, this syscall uses operation, flags,
and user pointer for arguments because strictly passing arguments via
a user pointer would mean seccomp itself would be unable to trivially
filter the seccomp syscall itself.
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Conflicts:
arch/x86/syscalls/syscall_32.tbl
arch/x86/syscalls/syscall_64.tbl
include/uapi/asm-generic/unistd.h
kernel/seccomp.c
And fixup of unistd32.h to truly enable sys_secomp.
Change-Id: I95bea02382c52007d22e5e9dc563c7d055c2c83f
Diffstat (limited to 'fs')
0 files changed, 0 insertions, 0 deletions