| Message ID | 20141021154614.GI5451@outflux.net |
|---|---|
| State | New |
| Headers | show |
On Tue, Oct 21, 2014 at 08:46:14AM -0700, Kees Cook wrote: > Hi! > > This is to backport the seccomp thread-sync (and syscall) interface from > 3.17. There was some backporting needed in a few areas, as marked in > []s before my SoB in the series. The most notable is skipping various > new syscalls (which are wired to sys_ni_syscall). > > This has been tested against the seccomp regression test suite on > x86_64. I don't have a working Ubuntu ARM test environment, so that > is presently untested. The series is, however, based on the Chrome OS > backport to 3.14, which builds and works on ARM. In theory it should be > fine on Ubuntu too! :) > > v3: > - drops accidentally-added chnagelog entry. > v2: > - fixes the ARM syscall count. (Specifically in > arch/arm/include/asm/unistd.h from "ARM: add seccomp syscall"). > > Thanks! > > -Kees Seems to have gone through a fair amount of testing, as per the test logs reported in bug #1379020. Cheers, -- Luís > > The following changes since commit 2d22fc7acd4f91209e5de492baceb84d8836e18c: > > UBUNTU: Ubuntu-3.13.0-38.65 (2014-10-09 10:32:10 +0100) > > are available in the git repository at: > > https://github.com/kees/linux.git ubuntu-trusty > > for you to fetch changes up to 0a0b87f3ab53e2267f47791f81ce0313b5e9d546: > > seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock (2014-10-21 08:39:43 -0700) > > ---------------------------------------------------------------- > Guenter Roeck (1): > seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock > > Kees Cook (11): > seccomp: create internal mode-setting function > seccomp: extract check/assign mode helpers > seccomp: split mode setting routines > seccomp: add "seccomp" syscall > ARM: add seccomp syscall > MIPS: add seccomp syscall > sched: move no_new_privs into new atomic flags > seccomp: split filter prep from check and apply > seccomp: introduce writer locking > seccomp: allow mode setting across threads > seccomp: implement SECCOMP_FILTER_FLAG_TSYNC > > Rashika Kheria (1): > UPSTREAM: kernel: Mark function as static in kernel/seccomp.c > > Will Deacon (1): > ARM: 8087/1: ptrace: reload syscall number after secure_computing() check > > arch/Kconfig | 1 + > arch/arm/include/asm/unistd.h | 2 +- > arch/arm/include/uapi/asm/unistd.h | 4 + > arch/arm/kernel/calls.S | 4 + > arch/arm/kernel/ptrace.c | 7 +- > arch/mips/include/uapi/asm/unistd.h | 24 +++- > arch/mips/kernel/scall32-o32.S | 4 + > arch/mips/kernel/scall64-64.S | 4 + > arch/mips/kernel/scall64-n32.S | 4 + > arch/mips/kernel/scall64-o32.S | 4 + > arch/x86/syscalls/syscall_32.tbl | 4 + > arch/x86/syscalls/syscall_64.tbl | 4 + > fs/exec.c | 6 +- > include/linux/sched.h | 18 ++- > include/linux/seccomp.h | 8 +- > include/linux/syscalls.h | 2 + > include/uapi/asm-generic/unistd.h | 10 +- > include/uapi/linux/seccomp.h | 7 + > kernel/fork.c | 49 ++++++- > kernel/seccomp.c | 412 +++++++++++++++++++++++++++++++++++++++++++++++++-------- > kernel/sys.c | 4 +- > kernel/sys_ni.c | 3 + > security/apparmor/domain.c | 4 +- > 23 files changed, 506 insertions(+), 83 deletions(-) > > -- > Kees Cook
Hi! This is to backport the seccomp thread-sync (and syscall) interface from 3.17. There was some backporting needed in a few areas, as marked in []s before my SoB in the series. The most notable is skipping various new syscalls (which are wired to sys_ni_syscall). This has been tested against the seccomp regression test suite on x86_64. I don't have a working Ubuntu ARM test environment, so that is presently untested. The series is, however, based on the Chrome OS backport to 3.14, which builds and works on ARM. In theory it should be fine on Ubuntu too! :) v3: - drops accidentally-added chnagelog entry. v2: - fixes the ARM syscall count. (Specifically in arch/arm/include/asm/unistd.h from "ARM: add seccomp syscall"). Thanks! -Kees The following changes since commit 2d22fc7acd4f91209e5de492baceb84d8836e18c: UBUNTU: Ubuntu-3.13.0-38.65 (2014-10-09 10:32:10 +0100) are available in the git repository at: https://github.com/kees/linux.git ubuntu-trusty for you to fetch changes up to 0a0b87f3ab53e2267f47791f81ce0313b5e9d546: seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock (2014-10-21 08:39:43 -0700) ---------------------------------------------------------------- Guenter Roeck (1): seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock Kees Cook (11): seccomp: create internal mode-setting function seccomp: extract check/assign mode helpers seccomp: split mode setting routines seccomp: add "seccomp" syscall ARM: add seccomp syscall MIPS: add seccomp syscall sched: move no_new_privs into new atomic flags seccomp: split filter prep from check and apply seccomp: introduce writer locking seccomp: allow mode setting across threads seccomp: implement SECCOMP_FILTER_FLAG_TSYNC Rashika Kheria (1): UPSTREAM: kernel: Mark function as static in kernel/seccomp.c Will Deacon (1): ARM: 8087/1: ptrace: reload syscall number after secure_computing() check arch/Kconfig | 1 + arch/arm/include/asm/unistd.h | 2 +- arch/arm/include/uapi/asm/unistd.h | 4 + arch/arm/kernel/calls.S | 4 + arch/arm/kernel/ptrace.c | 7 +- arch/mips/include/uapi/asm/unistd.h | 24 +++- arch/mips/kernel/scall32-o32.S | 4 + arch/mips/kernel/scall64-64.S | 4 + arch/mips/kernel/scall64-n32.S | 4 + arch/mips/kernel/scall64-o32.S | 4 + arch/x86/syscalls/syscall_32.tbl | 4 + arch/x86/syscalls/syscall_64.tbl | 4 + fs/exec.c | 6 +- include/linux/sched.h | 18 ++- include/linux/seccomp.h | 8 +- include/linux/syscalls.h | 2 + include/uapi/asm-generic/unistd.h | 10 +- include/uapi/linux/seccomp.h | 7 + kernel/fork.c | 49 ++++++- kernel/seccomp.c | 412 +++++++++++++++++++++++++++++++++++++++++++++++++-------- kernel/sys.c | 4 +- kernel/sys_ni.c | 3 + security/apparmor/domain.c | 4 +- 23 files changed, 506 insertions(+), 83 deletions(-)