Eric Lee / smarc-fsl-linux-kernel

19 Apr, 2012

1 commit

  • 561381a14   samples/seccomp: fix dependencies on arch macros ... Browse Code »

    This change fixes the compilation error triggered here for
    i386 allmodconfig in linux-next:
    http://kisskb.ellerman.id.au/kisskb/buildresult/6123842/

    Logic attempting to predict the host architecture has been
    removed from the Makefile. Instead, the bpf-direct sample
    should now compile on any architecture, but if the architecture
    is not supported, it will compile a minimal main() function.

    This change also ensures the samples are not compiled when
    there is no seccomp filter support.

    (Note, I wasn't able to reproduce the error locally, but
    the existing approach was clearly flawed. This tweak
    should resolve your issue and avoid other future weirdness.)

    Reported-by: Paul Gortmaker
    Suggested-by: Kees Cook
    Signed-off-by: Will Drewry
    Signed-off-by: James Morris

    Will Drewry
     

14 Apr, 2012

1 commit

  • 8ac270d1e   Documentation: prctl/seccomp_filter ... Browse Code »

    Documents how system call filtering using Berkeley Packet
    Filter programs works and how it may be used.
    Includes an example for x86 and a semi-generic
    example using a macro-based code generator.

    Acked-by: Eric Paris
    Signed-off-by: Will Drewry
    Acked-by: Kees Cook

    v18: - added acked by
    - update no new privs numbers
    v17: - remove @compat note and add Pitfalls section for arch checking
    (keescook@chromium.org)
    v16: -
    v15: -
    v14: - rebase/nochanges
    v13: - rebase on to 88ebdda6159ffc15699f204c33feb3e431bf9bdc
    v12: - comment on the ptrace_event use
    - update arch support comment
    - note the behavior of SECCOMP_RET_DATA when there are multiple filters
    (keescook@chromium.org)
    - lots of samples/ clean up incl 64-bit bpf-direct support
    (markus@chromium.org)
    - rebase to linux-next
    v11: - overhaul return value language, updates (keescook@chromium.org)
    - comment on do_exit(SIGSYS)
    v10: - update for SIGSYS
    - update for new seccomp_data layout
    - update for ptrace option use
    v9: - updated bpf-direct.c for SIGILL
    v8: - add PR_SET_NO_NEW_PRIVS to the samples.
    v7: - updated for all the new stuff in v7: TRAP, TRACE
    - only talk about PR_SET_SECCOMP now
    - fixed bad JLE32 check (coreyb@linux.vnet.ibm.com)
    - adds dropper.c: a simple system call disabler
    v6: - tweak the language to note the requirement of
    PR_SET_NO_NEW_PRIVS being called prior to use. (luto@mit.edu)
    v5: - update sample to use system call arguments
    - adds a "fancy" example using a macro-based generator
    - cleaned up bpf in the sample
    - update docs to mention arguments
    - fix prctl value (eparis@redhat.com)
    - language cleanup (rdunlap@xenotime.net)
    v4: - update for no_new_privs use
    - minor tweaks
    v3: - call out BPF Berkeley Packet Filter (rdunlap@xenotime.net)
    - document use of tentative always-unprivileged
    - guard sample compilation for i386 and x86_64
    v2: - move code to samples (corbet@lwn.net)
    Signed-off-by: James Morris

    Will Drewry