There are two possible scenarios for syscall filtering: - having a trusted/allowed range of PCs, and intercepting everything else - or the opposite: a single untrusted/intercepted range and allowing everything else (this is relevant for any kind of sandboxing scenario, or monitoring behavior of a single library) The current API only allows the former use case due to allowed range wrap-around check. Add PR_SYS_DISPATCH_INCLUSIVE_ON that enables the second use case. Add PR_SYS_DISPATCH_EXCLUSIVE_ON alias for PR_SYS_DISPATCH_ON to make it clear how it's different from the new PR_SYS_DISPATCH_INCLUSIVE_ON.
Showing the changes to include/uapi (1 of 4 files). Show all
Unified · Split
| @@ -255,7 +255,12 @@ struct prctl_mm_map { · 254 unmodified lines | |||
| 255 | /* Dispatch syscalls to a userspace handler */ | 255 | /* Dispatch syscalls to a userspace handler */ |
| 256 | #define PR_SET_SYSCALL_USER_DISPATCH 59 | 256 | #define PR_SET_SYSCALL_USER_DISPATCH 59 |
| 257 | # define PR_SYS_DISPATCH_OFF 0 | 257 | # define PR_SYS_DISPATCH_OFF 0 |
| 258 | # define PR_SYS_DISPATCH_ON 1 | 258 | /* Enable dispatch except for the specified range */ |
| 259 | # define PR_SYS_DISPATCH_EXCLUSIVE_ON 1 | ||
| 260 | /* Enable dispatch for the specified range */ | ||
| 261 | # define PR_SYS_DISPATCH_INCLUSIVE_ON 2 | ||
| 262 | /* Legacy name for backwards compatibility */ | ||
| 263 | # define PR_SYS_DISPATCH_ON PR_SYS_DISPATCH_EXCLUSIVE_ON | ||
| 259 | /* The control values for the user space selector when dispatch is enabled */ | 264 | /* The control values for the user space selector when dispatch is enabled */ |
| 260 | # define SYSCALL_DISPATCH_FILTER_ALLOW 0 | 265 | # define SYSCALL_DISPATCH_FILTER_ALLOW 0 |
| 261 | # define SYSCALL_DISPATCH_FILTER_BLOCK 1 | 266 | # define SYSCALL_DISPATCH_FILTER_BLOCK 1 |