[PATCH 7/8] x86: Enable seccomp constant action bitmaps
From: Kees Cook <hidden>
Date: 2020-06-16 07:50:13
Also in:
linux-api, lkml
Subsystem:
the rest, x86 architecture (32-bit and 64-bit) · Maintainers:
Linus Torvalds, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen
Now that CPU-local kernel TLB flushes are available to seccomp, define the specific architectures seccomp should be expected to reason about, so that constant action bitmaps can be enabled for x86. TODO: handle x32 via a "synthetic architecture" check, like done in syscall entry. Signed-off-by: Kees Cook <redacted> --- arch/x86/Kconfig | 1 + arch/x86/include/asm/syscall.h | 5 +++++ 2 files changed, 6 insertions(+)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 6a0cc524882d..0f7a0abab88f 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig@@ -149,6 +149,7 @@ config X86 select HAVE_ARCH_COMPAT_MMAP_BASES if MMU && COMPAT select HAVE_ARCH_PREL32_RELOCATIONS select HAVE_ARCH_SECCOMP_FILTER + select HAVE_ARCH_SECCOMP_BITMAP if !X86_X32 select HAVE_ARCH_THREAD_STRUCT_WHITELIST select HAVE_ARCH_STACKLEAK select HAVE_ARCH_TRACEHOOK
diff --git a/arch/x86/include/asm/syscall.h b/arch/x86/include/asm/syscall.h
index 7cbf733d11af..b89e86f4c061 100644
--- a/arch/x86/include/asm/syscall.h
+++ b/arch/x86/include/asm/syscall.h@@ -97,6 +97,7 @@ static inline void syscall_set_arguments(struct task_struct *task, memcpy(®s->bx + i, args, n * sizeof(args[0])); } +#define SECCOMP_ARCH AUDIT_ARCH_I386 static inline int syscall_get_arch(struct task_struct *task) { return AUDIT_ARCH_I386;
@@ -152,6 +153,10 @@ static inline void syscall_set_arguments(struct task_struct *task, } } +#define SECCOMP_ARCH AUDIT_ARCH_X86_64 +#ifdef CONFIG_COMPAT +#define SECCOMP_ARCH_COMPAT AUDIT_ARCH_I386 +#endif static inline int syscall_get_arch(struct task_struct *task) { /* x32 tasks should be considered AUDIT_ARCH_X86_64. */
--
2.25.1