This adds the new "seccomp" syscall with both an "operation" and "flags" parameter for future expansion. The third argument is a pointer value, used with the SECCOMP_SET_MODE_FILTER operation. Currently, flags must be 0. This is functionally equivalent to prctl(PR_SET_SECCOMP, ...). In addition to the TSYNC flag later in this patch series, there is a non-zero chance that this syscall could be used for configuring a fixed argument area for seccomp-tracer-aware processes to pass syscall arguments in the future. Hence, the use of "seccomp" not simply "seccomp_add_filter" for this syscall. Additionally, this syscall uses operation, flags, and user pointer for arguments because strictly passing arguments via a user pointer would mean seccomp itself would be unable to trivially filter the seccomp syscall itself.
Showing the changes to include/uapi/linux (1 of 8 files). Show all
Unified · Split
| @@ -10,6 +10,10 @@ · 9 unmodified lines | |||
| 10 | #define SECCOMP_MODE_STRICT 1 /* uses hard-coded filter. */ | 10 | #define SECCOMP_MODE_STRICT 1 /* uses hard-coded filter. */ |
| 11 | #define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */ | 11 | #define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */ |
| 12 | 12 | ||
| 13 | /* Valid operations for seccomp syscall. */ | ||
| 14 | #define SECCOMP_SET_MODE_STRICT 0 | ||
| 15 | #define SECCOMP_SET_MODE_FILTER 1 | ||
| 16 | |||
| 13 | /* | 17 | /* |
| 14 | * All BPF programs must return a 32-bit value. | 18 | * All BPF programs must return a 32-bit value. |
| 15 | * The bottom 16-bits are for optional return data. | 19 | * The bottom 16-bits are for optional return data. |