Userspace code that needs to check if the kernel supports a given action may not be able to use the /proc/sys/kernel/seccomp/actions_avail sysctl. The process may be running in a sandbox and, therefore, sufficient filesystem access may not be available. This patch adds an operation to the seccomp(2) syscall that allows userspace code to ask the kernel if a given action is available. If the action is supported by the kernel, 0 is returned. If the action is not supported by the kernel, -1 is returned with errno set to -EOPNOTSUPP. If this check is attempted on a kernel that doesn't support this new operation, -1 is returned with errno set to -EINVAL meaning that userspace code will have the ability to differentiate between the two error cases.
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -11,8 +11,9 @@ · 10 unmodified lines | |||
| 11 | #define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */ | 11 | #define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */ |
| 12 | 12 | ||
| 13 | /* Valid operations for seccomp syscall. */ | 13 | /* Valid operations for seccomp syscall. */ |
| 14 | #define SECCOMP_SET_MODE_STRICT 0 | 14 | #define SECCOMP_SET_MODE_STRICT 0 |
| 15 | #define SECCOMP_SET_MODE_FILTER 1 | 15 | #define SECCOMP_SET_MODE_FILTER 1 |
| 16 | #define SECCOMP_GET_ACTION_AVAIL 2 | ||
| 16 | 17 | ||
| 17 | /* Valid flags for SECCOMP_SET_MODE_FILTER */ | 18 | /* Valid flags for SECCOMP_SET_MODE_FILTER */ |
| 18 | #define SECCOMP_FILTER_FLAG_TSYNC 1 | 19 | #define SECCOMP_FILTER_FLAG_TSYNC 1 |