Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c63cb468 authored by Heiko Carstens's avatar Heiko Carstens Committed by Martin Schwidefsky
Browse files

s390/seccomp: add support for system call filtering using BPF 



Signed-off-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent e206d3da

arch/s390/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -124,6 +124,7 @@ config S390 
	select GENERIC_TIME_VSYSCALL

	select GENERIC_CLOCKEVENTS

	select KTIME_SCALAR if 32BIT

	select HAVE_ARCH_SECCOMP_FILTER



config SCHED_OMIT_FRAME_POINTER

	def_bool y

arch/s390/include/asm/syscall.h

+10 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
#ifndef _ASM_SYSCALL_H

#define _ASM_SYSCALL_H	1



#include <linux/audit.h>

#include <linux/sched.h>

#include <linux/err.h>

#include <asm/ptrace.h>
@@ -87,4 +88,13 @@ static inline void syscall_set_arguments(struct task_struct *task, 
		regs->orig_gpr2 = args[0];

}



static inline int syscall_get_arch(struct task_struct *task,

				   struct pt_regs *regs)

{

#ifdef CONFIG_COMPAT

	if (test_tsk_thread_flag(task, TIF_31BIT))

		return AUDIT_ARCH_S390;

#endif

	return sizeof(long) == 8 ? AUDIT_ARCH_S390X : AUDIT_ARCH_S390;

}

#endif	/* _ASM_SYSCALL_H */

arch/s390/kernel/ptrace.c

+6 −1
Original line number Diff line number Diff line
@@ -719,7 +719,11 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs) 
	long ret = 0;



	/* Do the secure computing check first. */

	secure_computing_strict(regs->gprs[2]);

	if (secure_computing(regs->gprs[2])) {

		/* seccomp failures shouldn't expose any additional code. */

		ret = -1;

		goto out;

	}



	/*

	 * The sysc_tracesys code in entry.S stored the system
@@ -745,6 +749,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs) 
			    regs->gprs[2], regs->orig_gpr2,

			    regs->gprs[3], regs->gprs[4],

			    regs->gprs[5]);

out:

	return ret ?: regs->gprs[2];

}