02 Nov, 2017

2 commits

  • Many user space API headers have licensing information, which is either
    incomplete, badly formatted or just a shorthand for referring to the
    license under which the file is supposed to be. This makes it hard for
    compliance tools to determine the correct license.

    Update these files with an SPDX license identifier. The identifier was
    chosen based on the license information in the file.

    GPL/LGPL licensed headers get the matching GPL/LGPL SPDX license
    identifier with the added 'WITH Linux-syscall-note' exception, which is
    the officially assigned exception identifier for the kernel syscall
    exception:

    NOTE! This copyright does *not* cover user programs that use kernel
    services by normal system calls - this is merely considered normal use
    of the kernel, and does *not* fall under the heading of "derived work".

    This exception makes it possible to include GPL headers into non GPL
    code, without confusing license compliance tools.

    Headers which have either explicit dual licensing or are just licensed
    under a non GPL license are updated with the corresponding SPDX
    identifier and the GPLv2 with syscall exception identifier. The format
    is:
    ((GPL-2.0 WITH Linux-syscall-note) OR SPDX-ID-OF-OTHER-LICENSE)

    SPDX license identifiers are a legally binding shorthand, which can be
    used instead of the full boiler plate text. The update does not remove
    existing license information as this has to be done on a case by case
    basis and the copyright holders might have to be consulted. This will
    happen in a separate step.

    This patch is based on work done by Thomas Gleixner and Kate Stewart and
    Philippe Ombredanne. See the previous patch in this series for the
    methodology of how this patch was researched.

    Reviewed-by: Kate Stewart
    Reviewed-by: Philippe Ombredanne
    Reviewed-by: Thomas Gleixner
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     
  • Many user space API headers are missing licensing information, which
    makes it hard for compliance tools to determine the correct license.

    By default are files without license information under the default
    license of the kernel, which is GPLV2. Marking them GPLV2 would exclude
    them from being included in non GPLV2 code, which is obviously not
    intended. The user space API headers fall under the syscall exception
    which is in the kernels COPYING file:

    NOTE! This copyright does *not* cover user programs that use kernel
    services by normal system calls - this is merely considered normal use
    of the kernel, and does *not* fall under the heading of "derived work".

    otherwise syscall usage would not be possible.

    Update the files which contain no license information with an SPDX
    license identifier. The chosen identifier is 'GPL-2.0 WITH
    Linux-syscall-note' which is the officially assigned identifier for the
    Linux syscall exception. SPDX license identifiers are a legally binding
    shorthand, which can be used instead of the full boiler plate text.

    This patch is based on work done by Thomas Gleixner and Kate Stewart and
    Philippe Ombredanne. See the previous patch in this series for the
    methodology of how this patch was researched.

    Reviewed-by: Kate Stewart
    Reviewed-by: Philippe Ombredanne
    Reviewed-by: Thomas Gleixner
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

04 Aug, 2017

1 commit

  • The send call ignores unknown flags. Legacy applications may already
    unwittingly pass MSG_ZEROCOPY. Continue to ignore this flag unless a
    socket opts in to zerocopy.

    Introduce socket option SO_ZEROCOPY to enable MSG_ZEROCOPY processing.
    Processes can also query this socket option to detect kernel support
    for the feature. Older kernels will return ENOPROTOOPT.

    Signed-off-by: Willem de Bruijn
    Signed-off-by: David S. Miller

    Willem de Bruijn
     

10 Jul, 2017

1 commit

  • Since commit fcc8487d477a ("uapi: export all headers under uapi
    directories"), all (and only) headers under uapi directories are
    exported, but asm-generic wrappers are still exceptions.

    To complete de-coupling the uapi from kernel headers, move generic-y
    of exported headers to uapi/asm/Kbuild.

    With this change, "make headers_install" will just need to parse
    uapi/asm/Kbuild to build up exported headers.

    Also, move "generic-y += kprobes.h" up in order to keep the entries
    sorted.

    Signed-off-by: Masahiro Yamada

    Masahiro Yamada
     

06 Jul, 2017

1 commit

  • Pull networking updates from David Miller:
    "Reasonably busy this cycle, but perhaps not as busy as in the 4.12
    merge window:

    1) Several optimizations for UDP processing under high load from
    Paolo Abeni.

    2) Support pacing internally in TCP when using the sch_fq packet
    scheduler for this is not practical. From Eric Dumazet.

    3) Support mutliple filter chains per qdisc, from Jiri Pirko.

    4) Move to 1ms TCP timestamp clock, from Eric Dumazet.

    5) Add batch dequeueing to vhost_net, from Jason Wang.

    6) Flesh out more completely SCTP checksum offload support, from
    Davide Caratti.

    7) More plumbing of extended netlink ACKs, from David Ahern, Pablo
    Neira Ayuso, and Matthias Schiffer.

    8) Add devlink support to nfp driver, from Simon Horman.

    9) Add RTM_F_FIB_MATCH flag to RTM_GETROUTE queries, from Roopa
    Prabhu.

    10) Add stack depth tracking to BPF verifier and use this information
    in the various eBPF JITs. From Alexei Starovoitov.

    11) Support XDP on qed device VFs, from Yuval Mintz.

    12) Introduce BPF PROG ID for better introspection of installed BPF
    programs. From Martin KaFai Lau.

    13) Add bpf_set_hash helper for TC bpf programs, from Daniel Borkmann.

    14) For loads, allow narrower accesses in bpf verifier checking, from
    Yonghong Song.

    15) Support MIPS in the BPF selftests and samples infrastructure, the
    MIPS eBPF JIT will be merged in via the MIPS GIT tree. From David
    Daney.

    16) Support kernel based TLS, from Dave Watson and others.

    17) Remove completely DST garbage collection, from Wei Wang.

    18) Allow installing TCP MD5 rules using prefixes, from Ivan
    Delalande.

    19) Add XDP support to Intel i40e driver, from Björn Töpel

    20) Add support for TC flower offload in nfp driver, from Simon
    Horman, Pieter Jansen van Vuuren, Benjamin LaHaise, Jakub
    Kicinski, and Bert van Leeuwen.

    21) IPSEC offloading support in mlx5, from Ilan Tayari.

    22) Add HW PTP support to macb driver, from Rafal Ozieblo.

    23) Networking refcount_t conversions, From Elena Reshetova.

    24) Add sock_ops support to BPF, from Lawrence Brako. This is useful
    for tuning the TCP sockopt settings of a group of applications,
    currently via CGROUPs"

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1899 commits)
    net: phy: dp83867: add workaround for incorrect RX_CTRL pin strap
    dt-bindings: phy: dp83867: provide a workaround for incorrect RX_CTRL pin strap
    cxgb4: Support for get_ts_info ethtool method
    cxgb4: Add PTP Hardware Clock (PHC) support
    cxgb4: time stamping interface for PTP
    nfp: default to chained metadata prepend format
    nfp: remove legacy MAC address lookup
    nfp: improve order of interfaces in breakout mode
    net: macb: remove extraneous return when MACB_EXT_DESC is defined
    bpf: add missing break in for the TCP_BPF_SNDCWND_CLAMP case
    bpf: fix return in load_bpf_file
    mpls: fix rtm policy in mpls_getroute
    net, ax25: convert ax25_cb.refcount from atomic_t to refcount_t
    net, ax25: convert ax25_route.refcount from atomic_t to refcount_t
    net, ax25: convert ax25_uid_assoc.refcount from atomic_t to refcount_t
    net, sctp: convert sctp_ep_common.refcnt from atomic_t to refcount_t
    net, sctp: convert sctp_transport.refcnt from atomic_t to refcount_t
    net, sctp: convert sctp_chunk.refcnt from atomic_t to refcount_t
    net, sctp: convert sctp_datamsg.refcnt from atomic_t to refcount_t
    net, sctp: convert sctp_auth_bytes.refcnt from atomic_t to refcount_t
    ...

    Linus Torvalds
     

21 Jun, 2017

1 commit

  • This adds the new getsockopt(2) option SO_PEERGROUPS on SOL_SOCKET to
    retrieve the auxiliary groups of the remote peer. It is designed to
    naturally extend SO_PEERCRED. That is, the underlying data is from the
    same credentials. Regarding its syntax, it is based on SO_PEERSEC. That
    is, if the provided buffer is too small, ERANGE is returned and @optlen
    is updated. Otherwise, the information is copied, @optlen is set to the
    actual size, and 0 is returned.

    While SO_PEERCRED (and thus `struct ucred') already returns the primary
    group, it lacks the auxiliary group vector. However, nearly all access
    controls (including kernel side VFS and SYSVIPC, but also user-space
    polkit, DBus, ...) consider the entire set of groups, rather than just
    the primary group. But this is currently not possible with pure
    SO_PEERCRED. Instead, user-space has to work around this and query the
    system database for the auxiliary groups of a UID retrieved via
    SO_PEERCRED.

    Unfortunately, there is no race-free way to query the auxiliary groups
    of the PID/UID retrieved via SO_PEERCRED. Hence, the current user-space
    solution is to use getgrouplist(3p), which itself falls back to NSS and
    whatever is configured in nsswitch.conf(3). This effectively checks
    which groups we *would* assign to the user if it logged in *now*. On
    normal systems it is as easy as reading /etc/group, but with NSS it can
    resort to quering network databases (eg., LDAP), using IPC or network
    communication.

    Long story short: Whenever we want to use auxiliary groups for access
    checks on IPC, we need further IPC to talk to the user/group databases,
    rather than just relying on SO_PEERCRED and the incoming socket. This
    is unfortunate, and might even result in dead-locks if the database
    query uses the same IPC as the original request.

    So far, those recursions / dead-locks have been avoided by using
    primitive IPC for all crucial NSS modules. However, we want to avoid
    re-inventing the wheel for each NSS module that might be involved in
    user/group queries. Hence, we would preferably make DBus (and other IPC
    that supports access-management based on groups) work without resorting
    to the user/group database. This new SO_PEERGROUPS ioctl would allow us
    to make dbus-daemon work without ever calling into NSS.

    Cc: Michal Sekletar
    Cc: Simon McVittie
    Reviewed-by: Tom Gundersen
    Signed-off-by: David Herrmann
    Signed-off-by: David S. Miller

    David Herrmann
     

04 Jun, 2017

1 commit

  • By moving the kernel side __SI_* defintions right next to the userspace
    ones we can kill the non-uapi versions of include
    include/asm-generic/siginfo.h and untangle the unholy mess of includes.

    [ tglx: Removed uapi/asm/siginfo.h from m32r, microblaze, mn10300 and score ]

    Signed-off-by: Christoph Hellwig
    Signed-off-by: Thomas Gleixner
    Cc: linux-arch@vger.kernel.org
    Cc: Fenghua Yu
    Cc: Tony Luck
    Cc: linux-ia64@vger.kernel.org
    Cc: Arnd Bergmann
    Cc: sparclinux@vger.kernel.org
    Cc: "David S. Miller"
    Link: http://lkml.kernel.org/r/20170603190102.28866-6-hch@lst.de

    Christoph Hellwig
     

22 May, 2017

1 commit


10 May, 2017

1 commit

  • Regularly, when a new header is created in include/uapi/, the developer
    forgets to add it in the corresponding Kbuild file. This error is usually
    detected after the release is out.

    In fact, all headers under uapi directories should be exported, thus it's
    useless to have an exhaustive list.

    After this patch, the following files, which were not exported, are now
    exported (with make headers_install_all):
    asm-arc/kvm_para.h
    asm-arc/ucontext.h
    asm-blackfin/shmparam.h
    asm-blackfin/ucontext.h
    asm-c6x/shmparam.h
    asm-c6x/ucontext.h
    asm-cris/kvm_para.h
    asm-h8300/shmparam.h
    asm-h8300/ucontext.h
    asm-hexagon/shmparam.h
    asm-m32r/kvm_para.h
    asm-m68k/kvm_para.h
    asm-m68k/shmparam.h
    asm-metag/kvm_para.h
    asm-metag/shmparam.h
    asm-metag/ucontext.h
    asm-mips/hwcap.h
    asm-mips/reg.h
    asm-mips/ucontext.h
    asm-nios2/kvm_para.h
    asm-nios2/ucontext.h
    asm-openrisc/shmparam.h
    asm-parisc/kvm_para.h
    asm-powerpc/perf_regs.h
    asm-sh/kvm_para.h
    asm-sh/ucontext.h
    asm-tile/shmparam.h
    asm-unicore32/shmparam.h
    asm-unicore32/ucontext.h
    asm-x86/hwcap2.h
    asm-xtensa/kvm_para.h
    drm/armada_drm.h
    drm/etnaviv_drm.h
    drm/vgem_drm.h
    linux/aspeed-lpc-ctrl.h
    linux/auto_dev-ioctl.h
    linux/bcache.h
    linux/btrfs_tree.h
    linux/can/vxcan.h
    linux/cifs/cifs_mount.h
    linux/coresight-stm.h
    linux/cryptouser.h
    linux/fsmap.h
    linux/genwqe/genwqe_card.h
    linux/hash_info.h
    linux/kcm.h
    linux/kcov.h
    linux/kfd_ioctl.h
    linux/lightnvm.h
    linux/module.h
    linux/nbd-netlink.h
    linux/nilfs2_api.h
    linux/nilfs2_ondisk.h
    linux/nsfs.h
    linux/pr.h
    linux/qrtr.h
    linux/rpmsg.h
    linux/sched/types.h
    linux/sed-opal.h
    linux/smc.h
    linux/smc_diag.h
    linux/stm.h
    linux/switchtec_ioctl.h
    linux/vfio_ccw.h
    linux/wil6210_uapi.h
    rdma/bnxt_re-abi.h

    Note that I have removed from this list the files which are generated in every
    exported directories (like .install or .install.cmd).

    Thanks to Julien Floret for the tip to get all
    subdirs with a pure makefile command.

    For the record, note that exported files for asm directories are a mix of
    files listed by:
    - include/uapi/asm-generic/Kbuild.asm;
    - arch//include/uapi/asm/Kbuild;
    - arch//include/asm/Kbuild.

    Signed-off-by: Nicolas Dichtel
    Acked-by: Daniel Vetter
    Acked-by: Russell King
    Acked-by: Mark Salter
    Acked-by: Michael Ellerman (powerpc)
    Signed-off-by: Masahiro Yamada

    Nicolas Dichtel
     

08 Apr, 2017

1 commit

  • Introduce a new getsockopt operation to retrieve the socket cookie
    for a specific socket based on the socket fd. It returns a unique
    non-decreasing cookie for each socket.
    Tested: https://android-review.googlesource.com/#/c/358163/

    Acked-by: Willem de Bruijn
    Signed-off-by: Chenbo Feng
    Signed-off-by: David S. Miller

    Chenbo Feng
     

25 Mar, 2017

1 commit

  • This socket option returns the NAPI ID associated with the queue on which
    the last frame is received. This information can be used by the apps to
    split the incoming flows among the threads based on the Rx queue on which
    they are received.

    If the NAPI ID actually represents a sender_cpu then the value is ignored
    and 0 is returned.

    Signed-off-by: Sridhar Samudrala
    Signed-off-by: Alexander Duyck
    Acked-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Sridhar Samudrala
     

23 Mar, 2017

1 commit

  • Allows reading of SK_MEMINFO_VARS via socket option. This way an
    application can get all meminfo related information in single socket
    option call instead of multiple calls.

    Adds helper function, sk_get_meminfo(), and uses that for both
    getsockopt and sock_diag_put_meminfo().

    Suggested by Eric Dumazet.

    Signed-off-by: Josh Hunt
    Reviewed-by: Jason Baron
    Acked-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Josh Hunt
     

30 Nov, 2016

1 commit

  • This patch exports the sender chronograph stats via the socket
    SO_TIMESTAMPING channel. Currently we can instrument how long a
    particular application unit of data was queued in TCP by tracking
    SOF_TIMESTAMPING_TX_SOFTWARE and SOF_TIMESTAMPING_TX_SCHED. Having
    these sender chronograph stats exported simultaneously along with
    these timestamps allow further breaking down the various sender
    limitation. For example, a video server can tell if a particular
    chunk of video on a connection takes a long time to deliver because
    TCP was experiencing small receive window. It is not possible to
    tell before this patch without packet traces.

    To prepare these stats, the user needs to set
    SOF_TIMESTAMPING_OPT_STATS and SOF_TIMESTAMPING_OPT_TSONLY flags
    while requesting other SOF_TIMESTAMPING TX timestamps. When the
    timestamps are available in the error queue, the stats are returned
    in a separate control message of type SCM_TIMESTAMPING_OPT_STATS,
    in a list of TLVs (struct nlattr) of types: TCP_NLA_BUSY_TIME,
    TCP_NLA_RWND_LIMITED, TCP_NLA_SNDBUF_LIMITED. Unit is microsecond.

    Signed-off-by: Francis Yan
    Signed-off-by: Yuchung Cheng
    Signed-off-by: Soheil Hassas Yeganeh
    Acked-by: Neal Cardwell
    Signed-off-by: David S. Miller

    Francis Yan
     

26 Feb, 2016

1 commit

  • This patch add the SO_CNX_ADVICE socket option (setsockopt only). The
    purpose is to allow an application to give feedback to the kernel about
    the quality of the network path for a connected socket. The value
    argument indicates the type of quality report. For this initial patch
    the only supported advice is a value of 1 which indicates "bad path,
    please reroute"-- the action taken by the kernel is to call
    dst_negative_advice which will attempt to choose a different ECMP route,
    reset the TX hash for flow label and UDP source port in encapsulation,
    etc.

    This facility should be useful for connected UDP sockets where only the
    application can provide any feedback about path quality. It could also
    be useful for TCP applications that have additional knowledge about the
    path outside of the normal TCP control loop.

    Signed-off-by: Tom Herbert
    Signed-off-by: David S. Miller

    Tom Herbert
     

05 Jan, 2016

1 commit

  • Expose socket options for setting a classic or extended BPF program
    for use when selecting sockets in an SO_REUSEPORT group. These options
    can be used on the first socket to belong to a group before bind or
    on any socket in the group after bind.

    This change includes refactoring of the existing sk_filter code to
    allow reuse of the existing BPF filter validation checks.

    Signed-off-by: Craig Gallek
    Acked-by: Alexei Starovoitov
    Signed-off-by: David S. Miller

    Craig Gallek
     

06 Dec, 2014

1 commit

  • introduce new setsockopt() command:

    setsockopt(sock, SOL_SOCKET, SO_ATTACH_BPF, &prog_fd, sizeof(prog_fd))

    where prog_fd was received from syscall bpf(BPF_PROG_LOAD, attr, ...)
    and attr->prog_type == BPF_PROG_TYPE_SOCKET_FILTER

    setsockopt() calls bpf_prog_get() which increments refcnt of the program,
    so it doesn't get unloaded while socket is using the program.

    The same eBPF program can be attached to multiple sockets.

    User task exit automatically closes socket which calls sk_filter_uncharge()
    which decrements refcnt of eBPF program

    Signed-off-by: Alexei Starovoitov
    Signed-off-by: David S. Miller

    Alexei Starovoitov
     

12 Nov, 2014

1 commit

  • Alternative to RPS/RFS is to use hardware support for multiple
    queues.

    Then split a set of million of sockets into worker threads, each
    one using epoll() to manage events on its own socket pool.

    Ideally, we want one thread per RX/TX queue/cpu, but we have no way to
    know after accept() or connect() on which queue/cpu a socket is managed.

    We normally use one cpu per RX queue (IRQ smp_affinity being properly
    set), so remembering on socket structure which cpu delivered last packet
    is enough to solve the problem.

    After accept(), connect(), or even file descriptor passing around
    processes, applications can use :

    int cpu;
    socklen_t len = sizeof(cpu);

    getsockopt(fd, SOL_SOCKET, SO_INCOMING_CPU, &cpu, &len);

    And use this information to put the socket into the right silo
    for optimal performance, as all networking stack should run
    on the appropriate cpu, without need to send IPI (RPS/RFS).

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

19 Jan, 2014

1 commit

  • For user space packet capturing libraries such as libpcap, there's
    currently only one way to check which BPF extensions are supported
    by the kernel, that is, commit aa1113d9f85d ("net: filter: return
    -EINVAL if BPF_S_ANC* operation is not supported"). For querying all
    extensions at once this might be rather inconvenient.

    Therefore, this patch introduces a new option which can be used as
    an argument for getsockopt(), and allows one to obtain information
    about which BPF extensions are supported by the current kernel.

    As David Miller suggests, we do not need to define any bits right
    now and status quo can just return 0 in order to state that this
    versions supports SKF_AD_PROTOCOL up to SKF_AD_PAY_OFFSET. Later
    additions to BPF extensions need to add their bits to the
    bpf_tell_extensions() function, as documented in the comment.

    Signed-off-by: Michal Sekletar
    Cc: David Miller
    Reviewed-by: Daniel Borkmann
    Signed-off-by: David S. Miller

    Michal Sekletar
     

29 Sep, 2013

1 commit

  • As mentioned in commit afe4fd062416b ("pkt_sched: fq: Fair Queue packet
    scheduler"), this patch adds a new socket option.

    SO_MAX_PACING_RATE offers the application the ability to cap the
    rate computed by transport layer. Value is in bytes per second.

    u32 val = 1000000;
    setsockopt(sockfd, SOL_SOCKET, SO_MAX_PACING_RATE, &val, sizeof(val));

    To be effectively paced, a flow must use FQ packet scheduler.

    Note that a packet scheduler takes into account the headers for its
    computations. The effective payload rate depends on MSS and retransmits
    if any.

    I chose to make this pacing rate a SOL_SOCKET option instead of a
    TCP one because this can be used by other protocols.

    Signed-off-by: Eric Dumazet
    Cc: Steinar H. Gunderson
    Cc: Michael Kerrisk
    Signed-off-by: David S. Miller

    Eric Dumazet
     

11 Jul, 2013

1 commit

  • Rename LL_SO to BUSY_POLL_SO
    Rename sysctl_net_ll_{read,poll} to sysctl_busy_{read,poll}
    Fix up users of these variables.
    Fix documentation for sysctl.

    a patch for the socket.7 man page will follow separately,
    because of limitations of my mail setup.

    Signed-off-by: Eliezer Tamir
    Signed-off-by: David S. Miller

    Eliezer Tamir
     

18 Jun, 2013

1 commit


01 Apr, 2013

1 commit

  • Currently, when a socket receives something on the error queue it only wakes up
    the socket on select if it is in the "read" list, that is the socket has
    something to read. It is useful also to wake the socket if it is in the error
    list, which would enable software to wait on error queue packets without waking
    up for regular data on the socket. The main use case is for receiving
    timestamped transmit packets which return the timestamp to the socket via the
    error queue. This enables an application to select on the socket for the error
    queue only instead of for the regular traffic.

    -v2-
    * Added the SO_SELECT_ERR_QUEUE socket option to every architechture specific file
    * Modified every socket poll function that checks error queue

    Signed-off-by: Jacob Keller
    Cc: Jeffrey Kirsher
    Cc: Richard Cochran
    Cc: Matthew Vick
    Signed-off-by: David S. Miller

    Keller, Jacob E
     

14 Mar, 2013

1 commit

  • In the UAPI header files, __BIG_ENDIAN and __LITTLE_ENDIAN must be
    compared against __BYTE_ORDER in preprocessor conditionals where these are
    exposed to userspace (that is they're not inside __KERNEL__ conditionals).

    However, in the main kernel the norm is to check for
    "defined(__XXX_ENDIAN)" rather than comparing against __BYTE_ORDER and
    this has incorrectly leaked into the userspace headers.

    The definition of struct stat64 in M32R's asm/stat.h is wrong in this way.
    Note that userspace will likely interpret the field order incorrectly as
    the big-endian variant on little-endian machines - depending on header
    inclusion order.

    [!!!] NOTE [!!!] This patch may adversely change the userspace API. It might
    be better to fix the ordering of st_blocks and __pad4 in struct stat64.

    Signed-off-by: David Howells
    Cc: Hirokazu Takata
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     

24 Jan, 2013

1 commit


17 Jan, 2013

1 commit

  • While a privileged program can open a raw socket, attach some
    restrictive filter and drop its privileges (or send the socket to an
    unprivileged program through some Unix socket), the filter can still
    be removed or modified by the unprivileged program. This commit adds a
    socket option to lock the filter (SO_LOCK_FILTER) preventing any
    modification of a socket filter program.

    This is similar to OpenBSD BIOCLOCK ioctl on bpf sockets, except even
    root is not allowed change/drop the filter.

    The state of the lock can be read with getsockopt(). No error is
    triggered if the state is not changed. -EPERM is returned when a user
    tries to remove the lock or to change/remove the filter while the lock
    is active. The check is done directly in sk_attach_filter() and
    sk_detach_filter() and does not affect only setsockopt() syscall.

    Signed-off-by: Vincent Bernat
    Signed-off-by: David S. Miller

    Vincent Bernat
     

21 Dec, 2012

1 commit

  • Pull signal handling cleanups from Al Viro:
    "sigaltstack infrastructure + conversion for x86, alpha and um,
    COMPAT_SYSCALL_DEFINE infrastructure.

    Note that there are several conflicts between "unify
    SS_ONSTACK/SS_DISABLE definitions" and UAPI patches in mainline;
    resolution is trivial - just remove definitions of SS_ONSTACK and
    SS_DISABLED from arch/*/uapi/asm/signal.h; they are all identical and
    include/uapi/linux/signal.h contains the unified variant."

    Fixed up conflicts as per Al.

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal:
    alpha: switch to generic sigaltstack
    new helpers: __save_altstack/__compat_save_altstack, switch x86 and um to those
    generic compat_sys_sigaltstack()
    introduce generic sys_sigaltstack(), switch x86 and um to it
    new helper: compat_user_stack_pointer()
    new helper: restore_altstack()
    unify SS_ONSTACK/SS_DISABLE definitions
    new helper: current_user_stack_pointer()
    missing user_stack_pointer() instances
    Bury the conditionals from kernel_thread/kernel_execve series
    COMPAT_SYSCALL_DEFINE: infrastructure

    Linus Torvalds
     

20 Dec, 2012

1 commit


03 Oct, 2012

1 commit