diff options
| author | Michael Schmitz <schmitzmic@gmail.com> | 2023-01-12 06:55:28 +0300 |
|---|---|---|
| committer | Geert Uytterhoeven <geert@linux-m68k.org> | 2023-01-30 18:40:15 +0300 |
| commit | 6baaade15594b28195da369962208b1f658e7342 (patch) | |
| tree | 52b25795388cc48527daad004758e1d7d539315c /arch/m68k/kernel | |
| parent | 2ca8a1de4437f21562e57f9ac123914747a8e7a1 (diff) | |
| download | linux-6baaade15594b28195da369962208b1f658e7342.tar.xz | |
m68k: Add kernel seccomp support
Add secure_computing() call to syscall_trace_enter to actually
filter system calls.
Add necessary arch Kconfig options, define TIF_SECCOMP trace
flag and provide basic seccomp filter support in asm/syscall.h
syscall_get_nr currently uses the syscall nr stored in orig_d0
because we change d0 to a default return code before starting a
syscall trace. This may be inconsistent with syscall_rollback
copying orig_d0 to d0 (which we never check upon return from
trace). We use d0 for the return code from syscall_trace_enter
in entry.S currently, and could perhaps expand that to store
a new syscall number returned by the seccomp filter before
executing the syscall. This clearly needs some discussion.
seccomp_bpf self test on ARAnyM passes 81 out of 94 tests.
Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/r/20230112035529.13521-3-schmitzmic@gmail.com
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Diffstat (limited to 'arch/m68k/kernel')
| -rw-r--r-- | arch/m68k/kernel/entry.S | 3 | ||||
| -rw-r--r-- | arch/m68k/kernel/ptrace.c | 6 |
2 files changed, 8 insertions, 1 deletions
diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S index 42879e6eb651..4dd2fd7acba9 100644 --- a/arch/m68k/kernel/entry.S +++ b/arch/m68k/kernel/entry.S @@ -214,6 +214,9 @@ ENTRY(system_call) | syscall trace? tstb %a1@(TINFO_FLAGS+2) jmi do_trace_entry + | seccomp filter active? + btst #5,%a1@(TINFO_FLAGS+2) + bnes do_trace_entry cmpl #NR_syscalls,%d0 jcc badsys syscall: diff --git a/arch/m68k/kernel/ptrace.c b/arch/m68k/kernel/ptrace.c index 0a4184a37461..cd0172d29430 100644 --- a/arch/m68k/kernel/ptrace.c +++ b/arch/m68k/kernel/ptrace.c @@ -21,7 +21,7 @@ #include <linux/signal.h> #include <linux/regset.h> #include <linux/elf.h> - +#include <linux/seccomp.h> #include <linux/uaccess.h> #include <asm/page.h> #include <asm/processor.h> @@ -278,6 +278,10 @@ asmlinkage int syscall_trace_enter(void) if (test_thread_flag(TIF_SYSCALL_TRACE)) ret = ptrace_report_syscall_entry(task_pt_regs(current)); + + if (secure_computing() == -1) + return -1; + return ret; } |