| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1331781125-15658-1-git-send-email-wad@chromium.org> Date: Wed, 14 Mar 2012 22:11:52 -0500 From: Will Drewry <wad@...omium.org> To: linux-kernel@...r.kernel.org Cc: linux-arch@...r.kernel.org, linux-doc@...r.kernel.org, kernel-hardening@...ts.openwall.com, netdev@...r.kernel.org, x86@...nel.org, arnd@...db.de, davem@...emloft.net, hpa@...or.com, mingo@...hat.com, oleg@...hat.com, peterz@...radead.org, rdunlap@...otime.net, mcgrathr@...omium.org, tglx@...utronix.de, luto@....edu, eparis@...hat.com, serge.hallyn@...onical.com, djm@...drot.org, scarybeasts@...il.com, indan@....nu, pmoore@...hat.com, akpm@...ux-foundation.org, corbet@....net, eric.dumazet@...il.com, markus@...omium.org, coreyb@...ux.vnet.ibm.com, keescook@...omium.org, Will Drewry <wad@...omium.org> Subject: [PATCH v15 00/13] seccomp_filter: syscall filtering using BPF Please see prior revisions of this patch series for a high level blurb. This revision makes a number of refinements and tweaks. The biggest change is a slight renumbering of the return codes which will break existing code using this patch series. I believe this patch is in good shape, and I don't see the need for any more API changes at this point. I plan to start using this revision more extensively, and I'd certainly appreciate any testing. Thanks! will Kees Cook (1): seccomp: remove duplicated failure logging Will Drewry (12): sk_run_filter: add BPF_S_ANC_SECCOMP_LD_W net/compat.c,linux/filter.h: share compat_sock_fprog seccomp: kill the seccomp_t typedef arch/x86: add syscall_get_arch to syscall.h asm/syscall.h: add syscall_get_arch seccomp: add system call filtering using BPF seccomp: add SECCOMP_RET_ERRNO signal, x86: add SIGSYS info and make it synchronous. seccomp: Add SECCOMP_RET_TRAP ptrace,seccomp: Add PTRACE_SECCOMP support x86: Enable HAVE_ARCH_SECCOMP_FILTER Documentation: prctl/seccomp_filter Documentation/prctl/seccomp_filter.txt | 156 +++++++++++ arch/Kconfig | 24 ++ arch/x86/Kconfig | 1 + arch/x86/ia32/ia32_signal.c | 4 + arch/x86/include/asm/ia32.h | 6 + arch/x86/include/asm/syscall.h | 23 ++ arch/x86/kernel/ptrace.c | 7 +- include/asm-generic/siginfo.h | 22 ++ include/asm-generic/syscall.h | 14 + include/linux/Kbuild | 1 + include/linux/audit.h | 8 +- include/linux/filter.h | 12 + include/linux/ptrace.h | 7 +- include/linux/sched.h | 2 +- include/linux/seccomp.h | 105 +++++++- kernel/auditsc.c | 10 +- kernel/fork.c | 3 + kernel/ptrace.c | 3 + kernel/seccomp.c | 446 ++++++++++++++++++++++++++++++-- kernel/signal.c | 9 +- kernel/sys.c | 2 +- net/compat.c | 8 - net/core/filter.c | 6 + samples/Makefile | 2 +- samples/seccomp/Makefile | 38 +++ samples/seccomp/bpf-direct.c | 176 +++++++++++++ samples/seccomp/bpf-fancy.c | 102 ++++++++ samples/seccomp/bpf-helper.c | 89 +++++++ samples/seccomp/bpf-helper.h | 238 +++++++++++++++++ samples/seccomp/dropper.c | 68 +++++ 30 files changed, 1538 insertions(+), 54 deletions(-) create mode 100644 Documentation/prctl/seccomp_filter.txt create mode 100644 samples/seccomp/Makefile create mode 100644 samples/seccomp/bpf-direct.c create mode 100644 samples/seccomp/bpf-fancy.c create mode 100644 samples/seccomp/bpf-helper.c create mode 100644 samples/seccomp/bpf-helper.h create mode 100644 samples/seccomp/dropper.c -- 1.7.5.4 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists