Will Drewry
acf3b2c71e
seccomp: add SECCOMP_RET_ERRNO ...
This change adds the SECCOMP_RET_ERRNO as a valid return value from a
seccomp filter. Additionally, it makes the first use of the lower
16-bits for storing a filter-supplied errno. 16-bits is more than
enough for the errno-base.h calls.
Returning errors instead of immediately terminating processes that
violate seccomp policy allow for broader use of this functionality
for kernel attack surface reduction. For example, a linux container
could maintain a whitelist of pre-existing system calls but drop
all new ones with errnos. This would keep a logically static attack
surface while providing errnos that may allow for graceful failure
without the downside of do_exit() on a bad call.
This change also changes the signature of __secure_computing. It
appears the only direct caller is the arm entry code and it clobbers
any possible return value (register) immediately.
Signed-off-by: Will Drewry <wad@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Eric Paris <eparis@redhat.com>
v18: - fix up comments and rebase
- fix bad var name which was fixed in later revs
- remove _int() and just change the __secure_computing signature
v16-v17: ...
v15: - use audit_seccomp and add a skip label. (eparis@redhat.com )
- clean up and pad out return codes (indan@nul.nu )
v14: - no change/rebase
v13: - rebase on to 88ebdda6159ffc15699f204c33feb3e431bf9bdc
v12: - move to WARN_ON if filter is NULL
(oleg@redhat.com , luto@mit.edu , keescook@chromium.org )
- return immediately for filter==NULL (keescook@chromium.org )
- change evaluation to only compare the ACTION so that layered
errnos don't result in the lowest one being returned.
(keeschook@chromium.org )
v11: - check for NULL filter (keescook@chromium.org )
v10: - change loaders to fn
v9: - n/a
v8: - update Kconfig to note new need for syscall_set_return_value.
- reordered such that TRAP behavior follows on later.
- made the for loop a little less indent-y
v7: - introduced
Signed-off-by: James Morris <james.l.morris@oracle.com>
2012-04-14 11:13:21 +10:00
2012-03-29 15:34:57 -07:00
2012-03-06 15:16:18 -05:00
2012-03-28 10:01:29 -07:00
2012-03-27 00:37:23 +01:00
2012-03-28 13:56:35 -07:00
2012-03-17 12:20:44 -07:00
2012-03-30 16:09:02 -07:00
2012-03-24 10:41:37 -07:00
2012-03-28 20:59:45 -07:00
2012-03-30 17:31:56 -07:00
2012-03-26 21:06:30 +02:00
2012-02-21 13:29:06 +01:00
2012-03-07 17:40:56 +01:00
2012-03-07 17:40:49 +01:00
2012-03-26 11:49:47 -04:00
2012-03-12 22:49:02 +01:00
2012-04-02 14:41:25 -07:00
2012-03-26 20:41:01 +04:00
2012-03-13 11:21:23 +11:00
2012-04-04 10:09:30 -07:00
2012-03-28 12:34:33 -07:00
2012-03-24 10:08:39 -07:00
2012-03-26 11:48:54 -04:00
2012-03-15 12:42:07 -07:00
2012-03-16 10:38:24 -04:00
2012-03-30 16:45:39 -07:00
2012-02-20 12:48:48 -08:00
2012-03-01 16:14:48 +01:00
2012-03-22 09:31:55 -04:00
2012-03-24 10:41:37 -07:00
2012-03-01 13:38:49 +01:00
2012-03-07 17:06:08 +11:00
2012-03-16 10:38:24 -04:00
2012-04-14 11:13:20 +10:00
2012-03-20 21:29:46 -04:00
2012-03-24 10:08:39 -07:00
2012-03-04 17:54:34 -05:00
2012-03-23 16:58:34 -07:00
2012-03-04 17:54:35 -05:00
2012-03-16 10:38:24 -04:00
2012-03-24 10:41:37 -07:00
2012-03-21 17:55:01 -07:00
2012-03-16 20:35:02 +00:00
2012-03-16 20:35:02 +00:00
2012-03-16 20:35:01 +00:00
2012-03-28 18:30:03 +01:00
2012-03-21 17:54:56 -07:00
2012-03-29 18:12:23 -07:00
2012-03-23 16:58:36 -07:00
2012-02-28 16:02:54 +01:00
2012-03-24 10:41:37 -07:00
2012-03-24 10:41:37 -07:00
2012-03-30 03:23:30 -04:00
2012-03-29 15:38:31 +10:30
2012-03-29 14:46:05 -07:00
2012-03-16 10:38:24 -04:00
2012-03-23 16:58:38 -07:00
2012-03-24 10:08:39 -07:00
2012-03-29 19:52:48 +08:00
2012-03-20 21:29:37 -04:00
2012-03-03 09:02:52 -07:00
2012-03-28 15:58:21 -07:00
2012-03-20 21:29:53 -04:00
2012-03-17 21:51:34 +01:00
2012-03-21 18:55:10 -07:00
2012-02-20 19:46:36 +11:00
2012-03-28 16:36:44 +02:00
2012-03-28 15:02:41 -07:00
2012-04-04 17:13:43 -07:00
2012-03-29 15:34:57 -07:00
2012-02-22 18:15:39 +05:30
2012-03-28 14:24:40 -07:00
2012-03-28 18:30:03 +01:00
2012-03-04 17:54:34 -05:00
2012-03-08 11:53:13 -08:00
2012-04-06 02:43:12 -04:00
2012-03-31 16:03:16 -04:00
2012-03-24 10:41:37 -07:00
2012-02-19 10:30:57 -08:00
2012-03-20 21:29:32 -04:00
2012-04-14 11:13:19 +10:00
2012-03-18 22:15:39 +01:00
2012-04-02 14:41:27 -07:00
2012-04-05 15:30:34 -07:00
2012-03-04 17:54:34 -05:00
2012-03-14 08:47:58 -04:00
2012-02-21 11:08:30 -05:00
2012-03-02 10:38:33 +01:00
2012-02-28 17:10:21 +00:00
2012-03-19 17:56:18 -07:00
2012-03-28 14:08:46 -07:00
2012-03-24 10:08:39 -07:00
2012-03-21 17:55:02 -07:00
2012-03-21 17:54:59 -07:00
2012-03-16 10:38:24 -04:00
2012-03-16 10:38:24 -04:00
2012-03-16 10:38:24 -04:00
2012-03-16 13:36:04 -07:00
2012-03-26 21:47:19 +02:00
2012-03-26 21:47:19 +02:00
2012-03-26 21:47:19 +02:00
2012-03-26 21:47:19 +02:00
2012-03-26 21:47:19 +02:00
2012-03-26 21:47:19 +02:00
2012-03-04 17:54:34 -05:00
2012-03-28 15:58:21 -07:00
2012-03-27 22:45:26 -04:00
2012-02-21 16:56:45 -05:00
2012-03-04 20:41:38 -05:00
2012-03-24 10:08:39 -07:00
2012-02-24 01:37:35 -08:00
2012-03-16 23:00:20 -07:00
2012-03-21 17:54:59 -07:00
2012-03-09 10:56:35 -08:00
2012-03-28 18:30:03 +01:00
2012-03-04 17:54:34 -05:00
2012-03-16 10:38:24 -04:00
2012-03-16 10:38:24 -04:00
2012-02-26 16:48:06 -07:00
2012-03-04 20:41:38 -05:00
2012-03-13 22:45:38 -04:00
2012-03-13 22:45:25 -04:00
2012-02-28 20:01:08 +01:00
2012-03-16 10:38:24 -04:00
2012-03-08 10:50:35 -08:00
2012-04-14 11:13:20 +10:00
2012-03-21 17:54:57 -07:00
2012-03-31 13:34:04 -07:00
2012-03-23 08:53:47 -07:00
2012-03-08 10:50:35 -08:00
2012-03-29 17:41:25 -05:00
2012-03-28 23:30:28 +02:00
2012-03-05 15:49:42 -08:00
2012-03-04 17:54:34 -05:00
2012-03-28 14:35:31 -07:00
2012-03-08 14:11:36 +02:00
2012-03-23 16:58:35 -07:00
2012-03-23 16:58:34 -07:00
2012-02-29 15:35:41 -06:00
2012-03-28 18:30:03 +01:00
2012-03-23 16:58:33 -07:00
2012-03-26 20:40:59 +04:00
2012-04-03 09:49:59 -07:00
2012-03-23 16:58:31 -07:00
2012-03-16 10:38:24 -04:00
2012-03-15 21:41:34 +01:00
2012-03-03 15:04:45 -05:00
2012-03-21 17:55:02 -07:00
2012-03-04 17:54:34 -05:00
2012-03-21 17:54:57 -07:00
2012-03-28 17:19:28 -07:00
2012-03-21 17:54:56 -07:00
2012-03-27 16:30:09 -07:00
2012-03-26 12:50:52 +10:30
2012-03-26 12:50:51 +10:30
2012-03-27 08:26:34 +01:00
2012-02-21 15:03:48 -05:00
2012-02-24 01:42:07 -08:00
2012-04-03 17:23:23 -04:00
2012-02-24 10:05:59 +01:00
2012-02-26 14:10:44 -05:00
2012-03-06 15:16:19 -05:00
2012-03-26 11:48:54 -04:00
2012-03-02 17:18:10 -05:00
2012-03-21 09:31:44 -04:00
2012-03-05 15:26:47 -05:00
2012-02-16 14:55:27 -05:00
2012-03-17 11:09:33 -04:00
2012-03-21 09:31:46 -04:00
2012-03-04 17:54:34 -05:00
2012-03-12 14:19:34 -04:00
2012-03-23 16:58:31 -07:00
2012-03-24 10:41:37 -07:00
2012-02-26 16:48:06 -07:00
2012-03-15 23:28:19 +08:00
2012-03-05 08:09:09 -07:00
2012-03-28 14:41:36 -07:00
2012-02-23 09:39:23 +02:00
2012-03-21 17:54:58 -07:00
2012-03-16 10:38:24 -04:00
2012-03-14 17:25:56 +08:00
2012-03-21 17:55:01 -07:00
2012-03-24 10:08:39 -07:00
2012-03-28 18:30:03 +01:00
2012-03-04 20:54:01 -05:00
2012-02-23 12:05:21 -08:00
2012-03-23 14:02:12 -07:00
2012-03-04 09:34:15 -08:00
2012-03-24 08:46:59 +01:00
2012-03-16 10:38:24 -04:00
2012-03-28 17:14:36 -07:00
2012-03-23 16:58:31 -07:00
2012-03-24 10:41:37 -07:00
2012-03-28 23:31:24 +02:00
2012-03-04 23:08:46 +01:00
2012-03-16 21:49:24 +01:00
2012-03-23 16:58:38 -07:00
2012-03-04 17:54:34 -05:00
2012-03-16 10:38:24 -04:00
2012-03-04 20:41:38 -05:00
2012-03-04 20:41:38 -05:00
2012-03-04 20:41:38 -05:00
2012-04-14 11:13:18 +10:00
2012-03-01 10:28:04 +01:00
2012-03-20 11:16:20 -07:00
2012-03-24 10:08:39 -07:00
2012-03-20 21:29:38 -04:00
2012-03-28 17:14:37 -07:00
2012-03-24 10:08:39 -07:00
2012-02-21 09:03:41 -08:00
2012-02-21 09:06:08 -08:00
2012-03-24 10:41:37 -07:00
2012-03-24 10:08:39 -07:00
2012-03-20 21:29:43 -04:00
2012-03-20 21:29:42 -04:00
2012-03-04 17:54:34 -05:00
2012-03-06 19:14:37 +02:00
2012-03-16 10:38:24 -04:00
2012-02-22 15:50:28 -05:00
2012-03-16 10:38:24 -04:00
2012-03-21 17:54:57 -07:00
2012-03-15 18:23:10 -07:00
2012-02-21 16:56:45 -05:00
2012-03-28 18:30:03 +01:00
2012-03-07 11:32:21 +00:00
2012-03-04 17:54:34 -05:00
2012-04-14 11:13:19 +10:00
2012-04-14 11:13:21 +10:00
2012-04-14 11:13:18 +10:00
2012-03-24 10:08:39 -07:00
2012-03-09 12:47:56 -08:00
2012-03-16 10:38:24 -04:00
2012-03-08 11:38:50 -08:00
2012-03-12 22:19:13 +01:00
2012-02-16 17:08:09 -05:00
2012-02-24 11:42:50 -08:00
2012-03-28 15:58:21 -07:00
2012-03-06 11:01:33 +02:00
2012-03-28 15:04:26 -07:00
2012-03-28 17:14:35 -07:00
2012-03-19 16:53:08 -04:00
2012-04-05 19:04:27 -04:00
2012-03-23 13:18:57 +01:00
2012-03-28 15:58:21 -07:00
2012-02-21 09:06:09 -08:00
2012-02-24 10:05:59 +01:00
2012-03-28 18:30:03 +01:00
2012-02-17 23:36:23 +01:00
2012-04-05 15:25:51 -07:00
2012-03-04 17:54:34 -05:00
2012-03-04 17:54:34 -05:00
2012-02-20 12:48:47 -08:00
2012-03-13 14:06:33 -04:00
2012-03-01 17:57:40 -05:00
2012-03-29 18:12:23 -07:00
2012-03-22 19:43:43 -07:00
2012-03-20 21:29:40 -04:00
2012-03-23 16:58:40 -07:00
2012-02-24 10:05:59 +01:00
2012-03-04 17:54:34 -05:00
2012-03-08 11:38:51 -08:00
2012-03-28 18:30:03 +01:00
2012-03-13 14:24:07 -07:00
2012-03-19 15:33:24 -03:00
2012-03-04 17:54:34 -05:00
2012-03-27 16:30:09 -07:00
2012-02-19 09:50:20 -06:00
2012-03-31 08:09:50 +05:30
2012-03-08 10:50:35 -08:00
2012-03-28 18:30:03 +01:00
2012-03-27 20:15:37 +02:00
2012-03-02 10:51:00 +01:00
2012-03-07 16:08:46 +01:00
acf3b2c71e