Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f41b450 authored by Kees Cook's avatar Kees Cook
Browse files

seccomp: extract check/assign mode helpers 



To support splitting mode 1 from mode 2, extract the mode checking and
assignment logic into common functions.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarOleg Nesterov <oleg@redhat.com>
Reviewed-by: default avatarAndy Lutomirski <luto@amacapital.net>
parent d78ab02c

kernel/seccomp.c

+18 −4
Original line number Diff line number Diff line
@@ -194,7 +194,23 @@ static u32 seccomp_run_filters(int syscall) 
	}

	return ret;

}

#endif /* CONFIG_SECCOMP_FILTER */



static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)

{

	if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)

		return false;



	return true;

}



static inline void seccomp_assign_mode(unsigned long seccomp_mode)

{

	current->seccomp.mode = seccomp_mode;

	set_tsk_thread_flag(current, TIF_SECCOMP);

}



#ifdef CONFIG_SECCOMP_FILTER

/**

 * seccomp_attach_filter: Attaches a seccomp filter to current.

 * @fprog: BPF program to install
@@ -490,8 +506,7 @@ static long seccomp_set_mode(unsigned long seccomp_mode, char __user *filter) 
{

	long ret = -EINVAL;



	if (current->seccomp.mode &&

	    current->seccomp.mode != seccomp_mode)

	if (!seccomp_may_assign_mode(seccomp_mode))

		goto out;



	switch (seccomp_mode) {
@@ -512,8 +527,7 @@ static long seccomp_set_mode(unsigned long seccomp_mode, char __user *filter) 
		goto out;

	}



	current->seccomp.mode = seccomp_mode;

	set_thread_flag(TIF_SECCOMP);

	seccomp_assign_mode(seccomp_mode);

out:

	return ret;

}