Skip to contentSkip to conversation

security: seccomp as extended attribute

PATCH New Michael Cassaniti 1 participant 1 message Dec 19, 2012 Secure computing

lore
Share & tools
lore

Michael Cassaniti

author
#0 lore raw

PATCH 2/2 security: seccomp as extended attribute

From Michael Cassaniti <[email protected]>

Add seccomp filter via extended attribute
Written against Linux 3.5

Signed-off-by Michael Cassaniti <[email protected]>

---

include/linux/seccomp.h 2012-09-21 12:44:09.915410558 +1000 renamed from include/linux/seccomp.h 2012-09-21 12:43:28.215772113 +1000 +5 -0
diff -uprN -X linux-3.5-rp1/Documentation/dontdiff linux-3.5-rp1/include/linux/seccomp.h linux-3.5-rp2/include/linux/seccomp.h
@@ -127,6 +127,11 @@ extern u32 seccomp_bpf_load(int off);
 #define SECCOMP_XATTR_BIT_DEF_RETURN    2
 #define SECCOMP_XATTR_BITMAP_START    3
 
+#define SECCOMP_FILTER_LOAD_SYSCALL BPF_STMT(BPF_LD|BPF_W|BPF_ABS, BPF_DATA(nr))
+#define SECCOMP_FILTER_ALLOW BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW)
+#define SECCOMP_FILTER_KILL  BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL)
+#define SECCOMP_FILTER_DENY BPF_STMT(BPF_RET|BPF_K, (SECCOMP_RET_ERRNO|EPERM))
+
 #else  /* CONFIG_SECCOMP_FILTER */
 static inline void put_seccomp_filter(struct task_struct *tsk)
 {
kernel/seccomp.c 2012-09-21 14:43:27.687445601 +1000 renamed from kernel/seccomp.c 2012-09-21 13:23:52.254969072 +1000 +176 -7

220 lines not on this page · raw message