c50b4659e4
This brings SECCOMP_MODE_STRICT and SECCOMP_MODE_FILTER support through prctl(2) and seccomp(2) to User-mode Linux for i386 and x86_64 subarchitectures. secure_computing() is called first in handle_syscall() so that the syscall emulation will be aborted quickly if matching a seccomp rule. This is inspired from Meredydd Luff's patch (https://gerrit.chromium.org/gerrit/21425). Signed-off-by: Mickaël Salaün <mic@digikod.net> Cc: Jeff Dike <jdike@addtoit.com> Cc: Richard Weinberger <richard@nod.at> Cc: Ingo Molnar <mingo@redhat.com> Cc: Kees Cook <keescook@chromium.org> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Will Drewry <wad@chromium.org> Cc: Chris Metcalf <cmetcalf@ezchip.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: James Hogan <james.hogan@imgtec.com> Cc: Meredydd Luff <meredydd@senatehouse.org> Cc: David Drysdale <drysdale@google.com> Signed-off-by: Richard Weinberger <richard@nod.at> Acked-by: Kees Cook <keescook@chromium.org>
41 lines
1.1 KiB
Plaintext
41 lines
1.1 KiB
Plaintext
#
|
|
# Feature name: seccomp-filter
|
|
# Kconfig: HAVE_ARCH_SECCOMP_FILTER
|
|
# description: arch supports seccomp filters
|
|
#
|
|
-----------------------
|
|
| arch |status|
|
|
-----------------------
|
|
| alpha: | TODO |
|
|
| arc: | TODO |
|
|
| arm: | ok |
|
|
| arm64: | ok |
|
|
| avr32: | TODO |
|
|
| blackfin: | TODO |
|
|
| c6x: | TODO |
|
|
| cris: | TODO |
|
|
| frv: | TODO |
|
|
| h8300: | TODO |
|
|
| hexagon: | TODO |
|
|
| ia64: | TODO |
|
|
| m32r: | TODO |
|
|
| m68k: | TODO |
|
|
| metag: | TODO |
|
|
| microblaze: | TODO |
|
|
| mips: | ok |
|
|
| mn10300: | TODO |
|
|
| nios2: | TODO |
|
|
| openrisc: | TODO |
|
|
| parisc: | TODO |
|
|
| powerpc: | TODO |
|
|
| s390: | ok |
|
|
| score: | TODO |
|
|
| sh: | TODO |
|
|
| sparc: | TODO |
|
|
| tile: | ok |
|
|
| um: | ok |
|
|
| unicore32: | TODO |
|
|
| x86: | ok |
|
|
| xtensa: | TODO |
|
|
-----------------------
|