Skip to content

Commit e994cc2

Browse files
torvaldstorvalds
committed
Merge tag 'seccomp-v5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull seccomp updates from Kees Cook: "The major change here is finally gaining seccomp constant-action bitmaps, which internally reduces the seccomp overhead for many real-world syscall filters to O(1), as discussed at Plumbers this year. - Improve seccomp performance via constant-action bitmaps (YiFei Zhu & Kees Cook) - Fix bogus __user annotations (Jann Horn) - Add missed CONFIG for improved selftest coverage (Mickaël Salaün)" * tag 'seccomp-v5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: selftests/seccomp: Update kernel config seccomp: Remove bogus __user annotations seccomp/cache: Report cache data through /proc/pid/seccomp_cache xtensa: Enable seccomp architecture tracking sh: Enable seccomp architecture tracking s390: Enable seccomp architecture tracking riscv: Enable seccomp architecture tracking powerpc: Enable seccomp architecture tracking parisc: Enable seccomp architecture tracking csky: Enable seccomp architecture tracking arm: Enable seccomp architecture tracking arm64: Enable seccomp architecture tracking selftests/seccomp: Compare bitmap vs filter overhead x86: Enable seccomp architecture tracking seccomp/cache: Add "emulator" to check if filter is constant allow seccomp/cache: Lookup syscall allowlist bitmap for fast path
2 parents ba1d41a + 2c07343 commit e994cc2

File tree

21 files changed

+590
-30
lines changed

21 files changed

+590
-30
lines changed

‎arch/Kconfig

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -486,6 +486,9 @@ config HAVE_ARCH_SECCOMP_FILTER
486486
- secure_computing return value is checked and a return value of -1
487487
results in the system call being skipped immediately.
488488
- seccomp syscall wired up
489+
- if !HAVE_SPARSE_SYSCALL_NR, have SECCOMP_ARCH_NATIVE,
490+
SECCOMP_ARCH_NATIVE_NR, SECCOMP_ARCH_NATIVE_NAME defined. If
491+
COMPAT is supported, have the SECCOMP_ARCH_COMPAT* defines too.
489492

490493
config SECCOMP
491494
prompt "Enable seccomp to safely execute untrusted bytecode"
@@ -514,6 +517,20 @@ config SECCOMP_FILTER
514517

515518
See Documentation/userspace-api/seccomp_filter.rst for details.
516519

520+
config SECCOMP_CACHE_DEBUG
521+
bool "Show seccomp filter cache status in /proc/pid/seccomp_cache"
522+
depends on SECCOMP_FILTER && !HAVE_SPARSE_SYSCALL_NR
523+
depends on PROC_FS
524+
help
525+
This enables the /proc/pid/seccomp_cache interface to monitor
526+
seccomp cache data. The file format is subject to change. Reading
527+
the file requires CAP_SYS_ADMIN.
528+
529+
This option is for debugging only. Enabling presents the risk that
530+
an adversary may be able to infer the seccomp filter logic.
531+
532+
If unsure, say N.
533+
517534
config HAVE_ARCH_STACKLEAK
518535
bool
519536
help

‎arch/arm/include/asm/Kbuild

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ generic-y += extable.h
44
generic-y += flat.h
55
generic-y += local64.h
66
generic-y += parport.h
7-
generic-y += seccomp.h
87

98
generated-y += mach-types.h
109
generated-y += unistd-nr.h

‎arch/arm/include/asm/seccomp.h

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
/* SPDX-License-Identifier: GPL-2.0-only */
2+
#ifndef _ASM_SECCOMP_H
3+
#define _ASM_SECCOMP_H
4+
5+
#include <asm-generic/seccomp.h>
6+
7+
#define SECCOMP_ARCH_NATIVE AUDIT_ARCH_ARM
8+
#define SECCOMP_ARCH_NATIVE_NR NR_syscalls
9+
#define SECCOMP_ARCH_NATIVE_NAME "arm"
10+
11+
#endif /* _ASM_SECCOMP_H */

‎arch/arm64/include/asm/seccomp.h

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,13 @@
1919

2020
#include <asm-generic/seccomp.h>
2121

22+
#define SECCOMP_ARCH_NATIVE AUDIT_ARCH_AARCH64
23+
#define SECCOMP_ARCH_NATIVE_NR NR_syscalls
24+
#define SECCOMP_ARCH_NATIVE_NAME "aarch64"
25+
#ifdef CONFIG_COMPAT
26+
# define SECCOMP_ARCH_COMPAT AUDIT_ARCH_ARM
27+
# define SECCOMP_ARCH_COMPAT_NR __NR_compat_syscalls
28+
# define SECCOMP_ARCH_COMPAT_NAME "arm"
29+
#endif
30+
2231
#endif /* _ASM_SECCOMP_H */

‎arch/csky/include/asm/Kbuild

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,5 @@ generic-y += gpio.h
44
generic-y += kvm_para.h
55
generic-y += local64.h
66
generic-y += qrwlock.h
7-
generic-y += seccomp.h
87
generic-y += user.h
98
generic-y += vmlinux.lds.h

‎arch/csky/include/asm/seccomp.h

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
/* SPDX-License-Identifier: GPL-2.0-only */
2+
#ifndef _ASM_SECCOMP_H
3+
#define _ASM_SECCOMP_H
4+
5+
#include <asm-generic/seccomp.h>
6+
7+
#define SECCOMP_ARCH_NATIVE AUDIT_ARCH_CSKY
8+
#define SECCOMP_ARCH_NATIVE_NR NR_syscalls
9+
#define SECCOMP_ARCH_NATIVE_NAME "csky"
10+
11+
#endif /* _ASM_SECCOMP_H */

‎arch/parisc/include/asm/Kbuild

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,4 @@ generated-y += syscall_table_c32.h
55
generic-y += kvm_para.h
66
generic-y += local64.h
77
generic-y += mcs_spinlock.h
8-
generic-y += seccomp.h
98
generic-y += user.h

‎arch/parisc/include/asm/seccomp.h

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/* SPDX-License-Identifier: GPL-2.0-only */
2+
#ifndef _ASM_SECCOMP_H
3+
#define _ASM_SECCOMP_H
4+
5+
#include <asm-generic/seccomp.h>
6+
7+
#ifdef CONFIG_64BIT
8+
# define SECCOMP_ARCH_NATIVE AUDIT_ARCH_PARISC64
9+
# define SECCOMP_ARCH_NATIVE_NR NR_syscalls
10+
# define SECCOMP_ARCH_NATIVE_NAME "parisc64"
11+
# ifdef CONFIG_COMPAT
12+
# define SECCOMP_ARCH_COMPAT AUDIT_ARCH_PARISC
13+
# define SECCOMP_ARCH_COMPAT_NR NR_syscalls
14+
# define SECCOMP_ARCH_COMPAT_NAME "parisc"
15+
# endif
16+
#else /* !CONFIG_64BIT */
17+
# define SECCOMP_ARCH_NATIVE AUDIT_ARCH_PARISC
18+
# define SECCOMP_ARCH_NATIVE_NR NR_syscalls
19+
# define SECCOMP_ARCH_NATIVE_NAME "parisc"
20+
#endif
21+
22+
#endif /* _ASM_SECCOMP_H */

‎arch/powerpc/include/asm/seccomp.h

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,27 @@
88

99
#include <asm-generic/seccomp.h>
1010

11+
#ifdef __LITTLE_ENDIAN__
12+
#define __SECCOMP_ARCH_LE __AUDIT_ARCH_LE
13+
#define __SECCOMP_ARCH_LE_NAME "le"
14+
#else
15+
#define __SECCOMP_ARCH_LE 0
16+
#define __SECCOMP_ARCH_LE_NAME
17+
#endif
18+
19+
#ifdef CONFIG_PPC64
20+
# define SECCOMP_ARCH_NATIVE (AUDIT_ARCH_PPC64 | __SECCOMP_ARCH_LE)
21+
# define SECCOMP_ARCH_NATIVE_NR NR_syscalls
22+
# define SECCOMP_ARCH_NATIVE_NAME "ppc64" __SECCOMP_ARCH_LE_NAME
23+
# ifdef CONFIG_COMPAT
24+
# define SECCOMP_ARCH_COMPAT (AUDIT_ARCH_PPC | __SECCOMP_ARCH_LE)
25+
# define SECCOMP_ARCH_COMPAT_NR NR_syscalls
26+
# define SECCOMP_ARCH_COMPAT_NAME "ppc" __SECCOMP_ARCH_LE_NAME
27+
# endif
28+
#else /* !CONFIG_PPC64 */
29+
# define SECCOMP_ARCH_NATIVE (AUDIT_ARCH_PPC | __SECCOMP_ARCH_LE)
30+
# define SECCOMP_ARCH_NATIVE_NR NR_syscalls
31+
# define SECCOMP_ARCH_NATIVE_NAME "ppc" __SECCOMP_ARCH_LE_NAME
32+
#endif
33+
1134
#endif /* _ASM_POWERPC_SECCOMP_H */

‎arch/riscv/include/asm/seccomp.h

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,14 @@
77

88
#include <asm-generic/seccomp.h>
99

10+
#ifdef CONFIG_64BIT
11+
# define SECCOMP_ARCH_NATIVE AUDIT_ARCH_RISCV64
12+
# define SECCOMP_ARCH_NATIVE_NR NR_syscalls
13+
# define SECCOMP_ARCH_NATIVE_NAME "riscv64"
14+
#else /* !CONFIG_64BIT */
15+
# define SECCOMP_ARCH_NATIVE AUDIT_ARCH_RISCV32
16+
# define SECCOMP_ARCH_NATIVE_NR NR_syscalls
17+
# define SECCOMP_ARCH_NATIVE_NAME "riscv32"
18+
#endif
19+
1020
#endif /* _ASM_SECCOMP_H */

0 commit comments

Comments
 (0)