Seccomp wants to know the syscall bitness, not the caller task bitness, when it selects the syscall whitelist. As far as I know, this makes no difference on any architecture, so it's not a security problem. (It generates identical code everywhere except sparc, and, on sparc, the syscall numbering is the same for both ABIs.)
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -395,7 +395,7 @@ seccomp_prepare_user_filter(const char __user *user_filter) · 394 unmodified lines | ||
| 395 | 395 | struct seccomp_filter *filter = ERR_PTR(-EFAULT); |
| 396 | 396 | |
| 397 | 397 | #ifdef CONFIG_COMPAT |
| 398 | − if (is_compat_task()) { | |
| 398 | + if (in_compat_syscall()) { | |
| 399 | 399 | struct compat_sock_fprog fprog32; |
| 400 | 400 | if (copy_from_user(&fprog32, user_filter, sizeof(fprog32))) |
| 401 | 401 | goto out; |
| @@ -529,7 +529,7 @@ static void __secure_computing_strict(int this_syscall) · 127 unmodified lines | ||
| 529 | 529 | { |
| 530 | 530 | int *syscall_whitelist = mode1_syscalls; |
| 531 | 531 | #ifdef CONFIG_COMPAT |
| 532 | − if (is_compat_task()) | |
| 532 | + if (in_compat_syscall()) | |
| 533 | 533 | syscall_whitelist = mode1_syscalls_32; |
| 534 | 534 | #endif |
| 535 | 535 | do { |