diff options
| author | Michael Schmitz <schmitzmic@gmail.com> | 2023-01-12 06:55:28 +0300 |
|---|---|---|
| committer | Geert Uytterhoeven <geert@linux-m68k.org> | 2023-01-30 18:40:15 +0300 |
| commit | 6baaade15594b28195da369962208b1f658e7342 (patch) | |
| tree | 52b25795388cc48527daad004758e1d7d539315c /arch/m68k/kernel/entry.S | |
| parent | 2ca8a1de4437f21562e57f9ac123914747a8e7a1 (diff) | |
| download | linux-6baaade15594b28195da369962208b1f658e7342.tar.xz | |
m68k: Add kernel seccomp support
Add secure_computing() call to syscall_trace_enter to actually
filter system calls.
Add necessary arch Kconfig options, define TIF_SECCOMP trace
flag and provide basic seccomp filter support in asm/syscall.h
syscall_get_nr currently uses the syscall nr stored in orig_d0
because we change d0 to a default return code before starting a
syscall trace. This may be inconsistent with syscall_rollback
copying orig_d0 to d0 (which we never check upon return from
trace). We use d0 for the return code from syscall_trace_enter
in entry.S currently, and could perhaps expand that to store
a new syscall number returned by the seccomp filter before
executing the syscall. This clearly needs some discussion.
seccomp_bpf self test on ARAnyM passes 81 out of 94 tests.
Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/r/20230112035529.13521-3-schmitzmic@gmail.com
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Diffstat (limited to 'arch/m68k/kernel/entry.S')
| -rw-r--r-- | arch/m68k/kernel/entry.S | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S index 42879e6eb651..4dd2fd7acba9 100644 --- a/arch/m68k/kernel/entry.S +++ b/arch/m68k/kernel/entry.S @@ -214,6 +214,9 @@ ENTRY(system_call) | syscall trace? tstb %a1@(TINFO_FLAGS+2) jmi do_trace_entry + | seccomp filter active? + btst #5,%a1@(TINFO_FLAGS+2) + bnes do_trace_entry cmpl #NR_syscalls,%d0 jcc badsys syscall: |