lkml.org 
[lkml]   [2012]   [Apr]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v18 14/15] x86: Enable HAVE_ARCH_SECCOMP_FILTER
From
On Thu, Apr 12, 2012 at 2:48 PM, Will Drewry <wad@chromium.org> wrote:
> Enable support for seccomp filter on x86:
> - syscall_get_arch()
> - syscall_get_arguments()
> - syscall_rollback()
> - syscall_set_return_value()
> - SIGSYS siginfo_t support
> - secure_computing is called from a ptrace_event()-safe context
> - secure_computing return value is checked (see below).
>
> SECCOMP_RET_TRACE and SECCOMP_RET_TRAP may result in seccomp needing to
> skip a system call without killing the process.  This is done by
> returning a non-zero (-1) value from secure_computing.  This change
> makes x86 respect that return value.
>
> To ensure that minimal kernel code is exposed, a non-zero return value
> results in an immediate return to user space (with an invalid syscall
> number).
>
> Signed-off-by: Will Drewry <wad@chromium.org>
> Reviewed-by: H. Peter Anvin <hpa@zytor.com>
> Acked-by: Eric Paris <eparis@redhat.com>

Reviewed-by: Kees Cook <keescook@chromium.org>

--
Kees Cook
ChromeOS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2012-04-13 00:19    [W:0.211 / U:0.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site