History

tile: enable full SECCOMP support

Chris Metcalf committed 11 years ago

Commit a0ddef81 parent 38715df10 files · +57 −5Browse files

Unified · Split

10 files
  1. Documentation/features/seccomp/seccomp-filter/arch-support.txt +1 −1
  2. arch/tile/Kconfig +17 −0
  3. arch/tile/include/asm/Kbuild +1 −0
  4. arch/tile/include/asm/elf.h +1 −3
  5. arch/tile/include/asm/syscall.h +27 −1
  6. arch/tile/kernel/intvec_32.S +1 −0
  7. arch/tile/kernel/intvec_64.S +1 −0
  8. arch/tile/kernel/ptrace.c +3 −0
  9. include/uapi/linux/audit.h +3 −0
  10. include/uapi/linux/elf-em.h +2 −0
Documentation/features/seccomp/seccomp-filter/arch-support.txt+1−1
@@ -32,7 +32,7 @@ · 31 unmodified lines
32 | score: | TODO |32 | score: | TODO |
33 | sh: | TODO |33 | sh: | TODO |
34 | sparc: | TODO |34 | sparc: | TODO |
35 | tile: | TODO |35 | tile: | ok |
36 | um: | TODO |36 | um: | TODO |
37 | unicore32: | TODO |37 | unicore32: | TODO |
38 | x86: | ok |38 | x86: | ok |
arch/tile/Kconfig+17−0
@@ -32,6 +32,7 @@ config TILE · 31 unmodified lines
32 select EDAC_SUPPORT32 select EDAC_SUPPORT
33 select GENERIC_STRNCPY_FROM_USER33 select GENERIC_STRNCPY_FROM_USER
34 select GENERIC_STRNLEN_USER34 select GENERIC_STRNLEN_USER
35 select HAVE_ARCH_SECCOMP_FILTER
35 36
36# FIXME: investigate whether we need/want these options.37# FIXME: investigate whether we need/want these options.
37# select HAVE_IOREMAP_PROT38# select HAVE_IOREMAP_PROT
@@ -221,6 +222,22 @@ config COMPAT · 183 unmodified lines
221 If enabled, the kernel will support running TILE-Gx binaries222 If enabled, the kernel will support running TILE-Gx binaries
222 that were built with the -m32 option.223 that were built with the -m32 option.
223 224
225config SECCOMP
226 bool "Enable seccomp to safely compute untrusted bytecode"
227 depends on PROC_FS
228 help
229 This kernel feature is useful for number crunching applications
230 that may need to compute untrusted bytecode during their
231 execution. By using pipes or other transports made available to
232 the process as file descriptors supporting the read/write
233 syscalls, it's possible to isolate those applications in
234 their own address space using seccomp. Once seccomp is
235 enabled via prctl, it cannot be disabled and the task is only
236 allowed to execute a few safe syscalls defined by each seccomp
237 mode.
238
239 If unsure, say N.
240
224config SYSVIPC_COMPAT241config SYSVIPC_COMPAT
225 def_bool y242 def_bool y
226 depends on COMPAT && SYSVIPC243 depends on COMPAT && SYSVIPC
arch/tile/include/asm/Kbuild+1−0
@@ -28,6 +28,7 @@ generic-y += poll.h · 27 unmodified lines
28generic-y += posix_types.h28generic-y += posix_types.h
29generic-y += preempt.h29generic-y += preempt.h
30generic-y += resource.h30generic-y += resource.h
31generic-y += seccomp.h
31generic-y += sembuf.h32generic-y += sembuf.h
32generic-y += serial.h33generic-y += serial.h
33generic-y += shmbuf.h34generic-y += shmbuf.h
arch/tile/include/asm/elf.h+1−3
@@ -22,6 +22,7 @@ · 21 unmodified lines
22#include <arch/chip.h>22#include <arch/chip.h>
23 23
24#include <linux/ptrace.h>24#include <linux/ptrace.h>
25#include <linux/elf-em.h>
25#include <asm/byteorder.h>26#include <asm/byteorder.h>
26#include <asm/page.h>27#include <asm/page.h>
27 28
@@ -30,9 +31,6 @@ typedef unsigned long elf_greg_t; · 2 unmodified lines
30#define ELF_NGREG (sizeof(struct pt_regs) / sizeof(elf_greg_t))31#define ELF_NGREG (sizeof(struct pt_regs) / sizeof(elf_greg_t))
31typedef elf_greg_t elf_gregset_t[ELF_NGREG];32typedef elf_greg_t elf_gregset_t[ELF_NGREG];
32 33
33#define EM_TILEPRO 188
34#define EM_TILEGX 191
35
36/* Provide a nominal data structure. */34/* Provide a nominal data structure. */
37#define ELF_NFPREG 035#define ELF_NFPREG 0
38typedef double elf_fpreg_t;36typedef double elf_fpreg_t;
arch/tile/include/asm/syscall.h+27−1
@@ -20,6 +20,8 @@ · 19 unmodified lines
20 20
21#include <linux/sched.h>21#include <linux/sched.h>
22#include <linux/err.h>22#include <linux/err.h>
23#include <linux/audit.h>
24#include <linux/compat.h>
23#include <arch/abi.h>25#include <arch/abi.h>
24 26
25/* The array of function pointers for syscalls. */27/* The array of function pointers for syscalls. */
@@ -61,7 +63,15 @@ static inline void syscall_set_return_value(struct task_struct *task, · 35 unmodified lines
61 struct pt_regs *regs,63 struct pt_regs *regs,
62 int error, long val)64 int error, long val)
63{65{
64 regs->regs[0] = (long) error ?: val;66 if (error) {
67 /* R0 is the passed-in negative error, R1 is positive. */
68 regs->regs[0] = error;
69 regs->regs[1] = -error;
70 } else {
71 /* R1 set to zero to indicate no error. */
72 regs->regs[0] = val;
73 regs->regs[1] = 0;
74 }
65}75}
66 76
67static inline void syscall_get_arguments(struct task_struct *task,77static inline void syscall_get_arguments(struct task_struct *task,
@@ -82,4 +92,20 @@ static inline void syscall_set_arguments(struct task_struct *task, · 14 unmodified lines
82 memcpy(&regs[i], args, n * sizeof(args[0]));92 memcpy(&regs[i], args, n * sizeof(args[0]));
83}93}
84 94
95/*
96 * We don't care about endianness (__AUDIT_ARCH_LE bit) here because
97 * tile has the same system calls both on little- and big- endian.
98 */
99static inline int syscall_get_arch(void)
100{
101 if (is_compat_task())
102 return AUDIT_ARCH_TILEGX32;
103
104#ifdef CONFIG_TILEGX
105 return AUDIT_ARCH_TILEGX;
106#else
107 return AUDIT_ARCH_TILEPRO;
108#endif
109}
110
85#endif /* _ASM_TILE_SYSCALL_H */111#endif /* _ASM_TILE_SYSCALL_H */
arch/tile/kernel/intvec_32.S+1−0
@@ -1224,6 +1224,7 @@ handle_syscall: · 1223 unmodified lines
1224 jal do_syscall_trace_enter1224 jal do_syscall_trace_enter
1225 }1225 }
1226 FEEDBACK_REENTER(handle_syscall)1226 FEEDBACK_REENTER(handle_syscall)
1227 blz r0, .Lsyscall_sigreturn_skip
1227 1228
1228 /*1229 /*
1229 * We always reload our registers from the stack at this1230 * We always reload our registers from the stack at this
arch/tile/kernel/intvec_64.S+1−0
@@ -1247,6 +1247,7 @@ handle_syscall: · 1246 unmodified lines
1247 jal do_syscall_trace_enter1247 jal do_syscall_trace_enter
1248 }1248 }
1249 FEEDBACK_REENTER(handle_syscall)1249 FEEDBACK_REENTER(handle_syscall)
1250 bltz r0, .Lsyscall_sigreturn_skip
1250 1251
1251 /*1252 /*
1252 * We always reload our registers from the stack at this1253 * We always reload our registers from the stack at this
arch/tile/kernel/ptrace.c+3−0
@@ -262,6 +262,9 @@ int do_syscall_trace_enter(struct pt_regs *regs) · 261 unmodified lines
262 if (work & _TIF_NOHZ)262 if (work & _TIF_NOHZ)
263 user_exit();263 user_exit();
264 264
265 if (secure_computing() == -1)
266 return -1;
267
265 if (work & _TIF_SYSCALL_TRACE) {268 if (work & _TIF_SYSCALL_TRACE) {
266 if (tracehook_report_syscall_entry(regs))269 if (tracehook_report_syscall_entry(regs))
267 regs->regs[TREG_SYSCALL_NR] = -1;270 regs->regs[TREG_SYSCALL_NR] = -1;
include/uapi/linux/audit.h+3−0
@@ -382,6 +382,9 @@ enum { · 381 unmodified lines
382#define AUDIT_ARCH_SHEL64 (EM_SH|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)382#define AUDIT_ARCH_SHEL64 (EM_SH|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
383#define AUDIT_ARCH_SPARC (EM_SPARC)383#define AUDIT_ARCH_SPARC (EM_SPARC)
384#define AUDIT_ARCH_SPARC64 (EM_SPARCV9|__AUDIT_ARCH_64BIT)384#define AUDIT_ARCH_SPARC64 (EM_SPARCV9|__AUDIT_ARCH_64BIT)
385#define AUDIT_ARCH_TILEGX (EM_TILEGX|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
386#define AUDIT_ARCH_TILEGX32 (EM_TILEGX|__AUDIT_ARCH_LE)
387#define AUDIT_ARCH_TILEPRO (EM_TILEPRO|__AUDIT_ARCH_LE)
385#define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)388#define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
386 389
387#define AUDIT_PERM_EXEC 1390#define AUDIT_PERM_EXEC 1
include/uapi/linux/elf-em.h+2−0
@@ -38,6 +38,8 @@ · 37 unmodified lines
38#define EM_ALTERA_NIOS2 113 /* Altera Nios II soft-core processor */38#define EM_ALTERA_NIOS2 113 /* Altera Nios II soft-core processor */
39#define EM_TI_C6000 140 /* TI C6X DSPs */39#define EM_TI_C6000 140 /* TI C6X DSPs */
40#define EM_AARCH64 183 /* ARM 64 bit */40#define EM_AARCH64 183 /* ARM 64 bit */
41#define EM_TILEPRO 188 /* Tilera TILEPro */
42#define EM_TILEGX 191 /* Tilera TILE-Gx */
41#define EM_FRV 0x5441 /* Fujitsu FR-V */43#define EM_FRV 0x5441 /* Fujitsu FR-V */
42#define EM_AVR32 0x18ad /* Atmel AVR32 */44#define EM_AVR32 0x18ad /* Atmel AVR32 */
43 45

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t