lkml.org 
[lkml]   [2012]   [Apr]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v17 10/15] seccomp: add SECCOMP_RET_ERRNO
    On Thu, 29 Mar 2012 15:01:55 -0500
    Will Drewry <wad@chromium.org> wrote:

    > This change adds the SECCOMP_RET_ERRNO as a valid return value from a
    > seccomp filter. Additionally, it makes the first use of the lower
    > 16-bits for storing a filter-supplied errno. 16-bits is more than
    > enough for the errno-base.h calls.
    >
    > Returning errors instead of immediately terminating processes that
    > violate seccomp policy allow for broader use of this functionality
    > for kernel attack surface reduction. For example, a linux container
    > could maintain a whitelist of pre-existing system calls but drop
    > all new ones with errnos. This would keep a logically static attack
    > surface while providing errnos that may allow for graceful failure
    > without the downside of do_exit() on a bad call.
    >
    >
    > ...
    >
    > @@ -64,11 +65,17 @@ struct seccomp {
    > struct seccomp_filter *filter;
    > };
    >
    > -extern void __secure_computing(int);
    > -static inline void secure_computing(int this_syscall)
    > +/*
    > + * Direct callers to __secure_computing should be updated as
    > + * CONFIG_HAVE_ARCH_SECCOMP_FILTER propagates.

    Are there any such callers? There's one I see in arm, but it's called
    from assembly code.

    > + */
    > +extern void __secure_computing(int) __deprecated;
    > +extern int __secure_computing_int(int);
    > +static inline int secure_computing(int this_syscall)
    > {
    > if (unlikely(test_thread_flag(TIF_SECCOMP)))
    > - __secure_computing(this_syscall);
    > + return __secure_computing_int(this_syscall);
    > + return 0;
    > }
    >
    > ...
    >
    > void __secure_computing(int this_syscall)
    > {
    > + /* Filter calls should never use this function. */
    > + BUG_ON(current->seccomp.mode == SECCOMP_MODE_FILTER);
    > + __secure_computing_int(this_syscall);
    > +}
    > +
    > +int __secure_computing_int(int this_syscall)

    What the heck does "_int" mean here? I read it as "integer" but
    perhaps it's shorthand for "internal". Give us a better name, please.
    Or a code comment.

    > +{
    > int mode = current->seccomp.mode;
    > int exit_sig = 0;
    > int *syscall;
    > + u32 ret = SECCOMP_RET_KILL;
    > + int data;
    >
    > switch (mode) {
    > case SECCOMP_MODE_STRICT:



    \
     
     \ /
      Last update: 2012-04-06 23:21    [W:4.118 / U:0.104 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site