ACK: [Trusty][pull-request v3] LP: #1379020 (seccomp tsync)

[Luis Henriques]

On Tue, Oct 21, 2014 at 08:46:14AM -0700, Kees Cook wrote:
> Hi!
> 
> This is to backport the seccomp thread-sync (and syscall) interface from
> 3.17. There was some backporting needed in a few areas, as marked in
> []s before my SoB in the series. The most notable is skipping various
> new syscalls (which are wired to sys_ni_syscall).
> 
> This has been tested against the seccomp regression test suite on
> x86_64. I don't have a working Ubuntu ARM test environment, so that
> is presently untested. The series is, however, based on the Chrome OS
> backport to 3.14, which builds and works on ARM. In theory it should be
> fine on Ubuntu too! :)
> 
> v3:
> - drops accidentally-added chnagelog entry.
> v2:
> - fixes the ARM syscall count. (Specifically in
>   arch/arm/include/asm/unistd.h from "ARM: add seccomp syscall").
> 
> Thanks!
> 
> -Kees

Seems to have gone through a fair amount of testing, as per the test
logs reported in bug #1379020.

Cheers,
--
Luís

> 
> The following changes since commit 2d22fc7acd4f91209e5de492baceb84d8836e18c:
> 
>   UBUNTU: Ubuntu-3.13.0-38.65 (2014-10-09 10:32:10 +0100)
> 
> are available in the git repository at:
> 
>   https://github.com/kees/linux.git ubuntu-trusty
> 
> for you to fetch changes up to 0a0b87f3ab53e2267f47791f81ce0313b5e9d546:
> 
>   seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock (2014-10-21 08:39:43 -0700)
> 
> ----------------------------------------------------------------
> Guenter Roeck (1):
>       seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock
> 
> Kees Cook (11):
>       seccomp: create internal mode-setting function
>       seccomp: extract check/assign mode helpers
>       seccomp: split mode setting routines
>       seccomp: add "seccomp" syscall
>       ARM: add seccomp syscall
>       MIPS: add seccomp syscall
>       sched: move no_new_privs into new atomic flags
>       seccomp: split filter prep from check and apply
>       seccomp: introduce writer locking
>       seccomp: allow mode setting across threads
>       seccomp: implement SECCOMP_FILTER_FLAG_TSYNC
> 
> Rashika Kheria (1):
>       UPSTREAM: kernel: Mark function as static in kernel/seccomp.c
> 
> Will Deacon (1):
>       ARM: 8087/1: ptrace: reload syscall number after secure_computing() check
> 
>  arch/Kconfig                        |   1 +
>  arch/arm/include/asm/unistd.h       |   2 +-
>  arch/arm/include/uapi/asm/unistd.h  |   4 +
>  arch/arm/kernel/calls.S             |   4 +
>  arch/arm/kernel/ptrace.c            |   7 +-
>  arch/mips/include/uapi/asm/unistd.h |  24 +++-
>  arch/mips/kernel/scall32-o32.S      |   4 +
>  arch/mips/kernel/scall64-64.S       |   4 +
>  arch/mips/kernel/scall64-n32.S      |   4 +
>  arch/mips/kernel/scall64-o32.S      |   4 +
>  arch/x86/syscalls/syscall_32.tbl    |   4 +
>  arch/x86/syscalls/syscall_64.tbl    |   4 +
>  fs/exec.c                           |   6 +-
>  include/linux/sched.h               |  18 ++-
>  include/linux/seccomp.h             |   8 +-
>  include/linux/syscalls.h            |   2 +
>  include/uapi/asm-generic/unistd.h   |  10 +-
>  include/uapi/linux/seccomp.h        |   7 +
>  kernel/fork.c                       |  49 ++++++-
>  kernel/seccomp.c                    | 412 +++++++++++++++++++++++++++++++++++++++++++++++++--------
>  kernel/sys.c                        |   4 +-
>  kernel/sys_ni.c                     |   3 +
>  security/apparmor/domain.c          |   4 +-
>  23 files changed, 506 insertions(+), 83 deletions(-)
> 
> -- 
> Kees Cook
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20141021/bbaf5f29/attachment.sig>