seccomp: Operation for checking if an action is available

Userspace code that needs to check if the kernel supports a given action may not be able to use the /proc/sys/kernel/seccomp/actions_avail sysctl. The process may be running in a sandbox and, therefore, sufficient filesystem access may not be available. This patch adds an operation to the seccomp(2) syscall that allows userspace code to ask the kernel if a given action is available. If the action is supported by the kernel, 0 is returned. If the action is not supported by the kernel, -1 is returned with errno set to -EOPNOTSUPP. If this check is attempted on a kernel that doesn't support this new operation, -1 is returned with errno set to -EINVAL meaning that userspace code will have the ability to differentiate between the two error cases.

Tyler Hicks committed 9 years ago

Commit d612b1f1 parent 8e5f1ad3 files · +65 −2Browse files

Showing the changes to include/uapi/linux (1 of 3 files). Show all

Unified · Split

include/uapi/linux/seccomp.h+3−2

@@ -11,8 +11,9 @@ · 10 unmodified lines
11	11	#define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */
12	12
13	13	/* Valid operations for seccomp syscall. */
14		−#define SECCOMP_SET_MODE_STRICT 0
15		−#define SECCOMP_SET_MODE_FILTER 1
	14	+#define SECCOMP_SET_MODE_STRICT 0
	15	+#define SECCOMP_SET_MODE_FILTER 1
	16	+#define SECCOMP_GET_ACTION_AVAIL 2
16	17
17	18	/* Valid flags for SECCOMP_SET_MODE_FILTER */
18	19	#define SECCOMP_FILTER_FLAG_TSYNC 1