seccomp: add "seccomp" syscall
This adds the new "seccomp" syscall with both an "operation" and "flags" parameter for future expansion. The third argument is a pointer value, used with the SECCOMP_SET_MODE_FILTER operation. Currently, flags must be 0. This is functionally equivalent to prctl(PR_SET_SECCOMP, ...). In addition to the TSYNC flag later in this patch series, there is a non-zero chance that this syscall could be used for configuring a fixed argument area for seccomp-tracer-aware processes to pass syscall arguments in the future. Hence, the use of "seccomp" not simply "seccomp_add_filter" for this syscall. Additionally, this syscall uses operation, flags, and user pointer for arguments because strictly passing arguments via a user pointer would mean seccomp itself would be unable to trivially filter the seccomp syscall itself. And fixup of unistd32.h to truly enable sys_secomp. Signed-off-by:Kees Cook <keescook@chromium.org> Reviewed-by:
Oleg Nesterov <oleg@redhat.com> Reviewed-by:
Andy Lutomirski <luto@amacapital.net> Git-commit: e985fd474debedb269fba27006eda50d0b6f07ef Git-repo: https://www.codeaurora.org/cgit/external/gigabyte/kernel/msm [rsiddoji@codeaurora.org: dropped x86 and arm64 related changes] Change-Id: I95bea02382c52007d22e5e9dc563c7d055c2c83f Signed-off-by:
Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>
Loading
Please register or sign in to comment