Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7e812616 authored by Paul Lawrence's avatar Paul Lawrence Committed by Gerrit Code Review
Browse files

Merge "Optimize seccomp"

parents e724f82b 14f31aa6

core/jni/android_os_seccomp.cpp

+10 −6
Original line number Diff line number Diff line
@@ -122,6 +122,10 @@ bool set_seccomp_filter() { 
    // 64-bit filter

    ExamineSyscall(f);



    // arm64-only filter - autogenerated from bionic syscall usage

    for (size_t i = 0; i < arm64_filter_size; ++i)

        f.push_back(arm64_filter[i]);



    // Syscalls needed to boot Android

    AllowSyscall(f, 41);  // __NR_pivot_root

    AllowSyscall(f, 31);  // __NR_ioprio_get
@@ -143,9 +147,7 @@ bool set_seccomp_filter() { 
    // Needed for kernel to restart syscalls

    AllowSyscall(f, 128); // __NR_restart_syscall



    // arm64-only filter - autogenerated from bionic syscall usage

    for (size_t i = 0; i < arm64_filter_size; ++i)

        f.push_back(arm64_filter[i]);

    Trap(f);



    if (SetValidateArchitectureJumpTarget(offset_to_32bit_filter, f) != 0)

        return -1;
@@ -153,6 +155,10 @@ bool set_seccomp_filter() { 
    // 32-bit filter

    ExamineSyscall(f);



    // arm32 filter - autogenerated from bionic syscall usage

    for (size_t i = 0; i < arm_filter_size; ++i)

        f.push_back(arm_filter[i]);



    // Syscalls needed to boot android

    AllowSyscall(f, 120); // __NR_clone

    AllowSyscall(f, 240); // __NR_futex
@@ -200,9 +206,7 @@ bool set_seccomp_filter() { 
    // already allowed.

    AllowSyscall(f, 85);  // __NR_readlink



    // arm32 filter - autogenerated from bionic syscall usage

    for (size_t i = 0; i < arm_filter_size; ++i)

        f.push_back(arm_filter[i]);

    Trap(f);



    return install_filter(f);

}