From patchwork Tue Aug 23 14:58:14 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [Oneiric,pull,request] SECCOMP_FILTER patchset From: Kees Cook X-Patchwork-Id: 111124 Message-Id: <20110823145814.GE1834@outflux.net> To: kernel-team@lists.ubuntu.com Date: Tue, 23 Aug 2011 07:58:14 -0700 The following changes since commit 0f7b85456c26da7c277732d0a3549509f50b1de0: UBUNTU: Ubuntu-3.0.0-9.12 (2011-08-19 21:52:38 -0700) are available in the git repository at: git://kernel.ubuntu.com/kees/ubuntu-oneiric.git master Kees Cook (1): UBUNTU: [Config] enable and enforce SECCOMP_FILTER on x86 Will Drewry (4): UBUNTU: SAUCE: seccomp_filter: new mode with configurable syscall filters UBUNTU: SAUCE: seccomp_filter: add process state reporting UBUNTU: SAUCE: seccomp_filter: Document what seccomp_filter is and how it works. UBUNTU: SAUCE: seccomp_filter: add HAVE_SECCOMP_FILTER and seccomp_execve Documentation/prctl/seccomp_filter.txt | 189 +++++ arch/x86/Kconfig | 1 + arch/x86/include/asm/ia32_unistd.h | 1 + arch/x86/include/asm/seccomp_64.h | 2 + debian.master/config/amd64/config.common.amd64 | 1 + debian.master/config/enforce | 1 + debian.master/config/i386/config.common.i386 | 1 + fs/proc/base.c | 31 + include/linux/init_task.h | 12 + include/linux/prctl.h | 7 + include/linux/sched.h | 2 +- include/linux/seccomp.h | 119 +++- kernel/Makefile | 1 + kernel/fork.c | 4 + kernel/seccomp.c | 38 +- kernel/seccomp_filter.c | 1057 ++++++++++++++++++++++++ kernel/sys.c | 12 + security/Kconfig | 17 + 18 files changed, 1483 insertions(+), 13 deletions(-) create mode 100644 Documentation/prctl/seccomp_filter.txt create mode 100644 kernel/seccomp_filter.c This is take-2 on the pull request for the SECCOMP_FILTER feature. I've build and runtime tested this now, and it looks to be in good shape. It's enabled only for x86. Thanks! -Kees