6baaade155
Add secure_computing() call to syscall_trace_enter to actually filter system calls. Add necessary arch Kconfig options, define TIF_SECCOMP trace flag and provide basic seccomp filter support in asm/syscall.h syscall_get_nr currently uses the syscall nr stored in orig_d0 because we change d0 to a default return code before starting a syscall trace. This may be inconsistent with syscall_rollback copying orig_d0 to d0 (which we never check upon return from trace). We use d0 for the return code from syscall_trace_enter in entry.S currently, and could perhaps expand that to store a new syscall number returned by the seccomp filter before executing the syscall. This clearly needs some discussion. seccomp_bpf self test on ARAnyM passes 81 out of 94 tests. Signed-off-by: Michael Schmitz <schmitzmic@gmail.com> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://lore.kernel.org/r/20230112035529.13521-3-schmitzmic@gmail.com Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
11 lines
283 B
C
11 lines
283 B
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
#ifndef _ASM_SECCOMP_H
|
|
#define _ASM_SECCOMP_H
|
|
|
|
#include <asm-generic/seccomp.h>
|
|
|
|
#define SECCOMP_ARCH_NATIVE AUDIT_ARCH_M68K
|
|
#define SECCOMP_ARCH_NATIVE_NR NR_syscalls
|
|
#define SECCOMP_ARCH_NATIVE_NAME "m68k"
|
|
|
|
#endif /* _ASM_SECCOMP_H */
|