From patchwork Wed Mar 21 19:18:04 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [Precise,Pull,Request] SECCOMP mode 2, BPF Date: Wed, 21 Mar 2012 09:18:04 -0000 From: Kees Cook X-Patchwork-Id: 148064 Message-Id: <20120321191804.GR4432@outflux.net> To: kernel-team@lists.ubuntu.com The following changes since commit b0c18ca93ec9fec352594a5a1ab16c3aec131f96: Leann Ogasawara (1): UBUNTU: Ubuntu-3.2.0-19.31 are available in the git repository at: git://github.com/kees/linux.git ubuntu-precise Andy Lutomirski (1): UBUNTU: SAUCE: SECCOMP: Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs Eric Paris (1): seccomp: audit abnormal end to a process due to seccomp John Johansen (1): UBUNTU: SAUCE: SECCOMP: Fix apparmor for PR_{GET,SET}_NO_NEW_PRIVS Kees Cook (2): UBUNTU: SAUCE: SECCOMP: seccomp: remove duplicated failure logging UBUNTU: [Config] SECCOMP_FILTER=y Will Drewry (12): UBUNTU: SAUCE: SECCOMP: sk_run_filter: add BPF_S_ANC_SECCOMP_LD_W UBUNTU: SAUCE: SECCOMP: net/compat.c,linux/filter.h: share compat_sock_fprog UBUNTU: SAUCE: SECCOMP: seccomp: kill the seccomp_t typedef UBUNTU: SAUCE: SECCOMP: arch/x86: add syscall_get_arch to syscall.h UBUNTU: SAUCE: SECCOMP: asm/syscall.h: add syscall_get_arch UBUNTU: SAUCE: SECCOMP: seccomp: add system call filtering using BPF UBUNTU: SAUCE: SECCOMP: seccomp: add SECCOMP_RET_ERRNO UBUNTU: SAUCE: SECCOMP: signal, x86: add SIGSYS info and make it synchronous. UBUNTU: SAUCE: SECCOMP: seccomp: Add SECCOMP_RET_TRAP UBUNTU: SAUCE: SECCOMP: ptrace,seccomp: Add PTRACE_SECCOMP support UBUNTU: SAUCE: SECCOMP: x86: Enable HAVE_ARCH_SECCOMP_FILTER UBUNTU: SAUCE: SECCOMP: Documentation: prctl/seccomp_filter Documentation/prctl/seccomp_filter.txt | 156 +++++++++ arch/Kconfig | 24 ++ arch/x86/Kconfig | 1 + arch/x86/ia32/ia32_signal.c | 4 + arch/x86/include/asm/ia32.h | 6 + arch/x86/include/asm/syscall.h | 23 ++ arch/x86/kernel/ptrace.c | 7 +- debian.master/config/amd64/config.common.amd64 | 1 + debian.master/config/enforce | 2 +- debian.master/config/i386/config.common.i386 | 1 + fs/exec.c | 10 +- include/asm-generic/siginfo.h | 22 ++ include/asm-generic/syscall.h | 14 + include/linux/Kbuild | 1 + include/linux/audit.h | 8 + include/linux/filter.h | 12 + include/linux/prctl.h | 15 + include/linux/ptrace.h | 7 +- include/linux/sched.h | 4 +- include/linux/seccomp.h | 105 +++++- include/linux/security.h | 1 + kernel/auditsc.c | 58 ++-- kernel/fork.c | 3 + kernel/ptrace.c | 3 + kernel/seccomp.c | 446 +++++++++++++++++++++++- kernel/signal.c | 9 +- kernel/sys.c | 12 +- net/compat.c | 8 - net/core/filter.c | 6 + samples/Makefile | 2 +- samples/seccomp/Makefile | 38 ++ samples/seccomp/bpf-direct.c | 176 ++++++++++ samples/seccomp/bpf-fancy.c | 102 ++++++ samples/seccomp/bpf-helper.c | 89 +++++ samples/seccomp/bpf-helper.h | 238 +++++++++++++ samples/seccomp/dropper.c | 68 ++++ security/apparmor/domain.c | 35 ++ security/commoncap.c | 7 +- security/selinux/hooks.c | 10 +- 39 files changed, 1660 insertions(+), 74 deletions(-) create mode 100644 Documentation/prctl/seccomp_filter.txt create mode 100644 samples/seccomp/Makefile create mode 100644 samples/seccomp/bpf-direct.c create mode 100644 samples/seccomp/bpf-fancy.c create mode 100644 samples/seccomp/bpf-helper.c create mode 100644 samples/seccomp/bpf-helper.h create mode 100644 samples/seccomp/dropper.c