This adds SECCOMP_FILTER support for sparc64.
The arch prerequisites have been in place for years, so patch 1 is
mostly about the missing piece: letting seccomp veto a syscall, and
returning to user space with the return value the seccomp core set in
pt_regs rather than the -ENOSYS the assembler stubs used to force on
any denied syscall. Patch 2 teaches the seccomp_bpf selftest to
drive sparc64's registers.
Tested on an UltraSPARC T4-1 (sun4v):
- tools/testing/selftests/seccomp/seccomp_bpf: 95 passed, 0 failed,
16 skipped (uprobes and other optional features)
- libseccomp with its pending SPARC support (libseccomp PR #471)
passes its full suite, 5190 of 5190, including the live tests
that require kernel SECCOMP_FILTER
- docker containers run confined by the default profile, and a
custom SCMP_ACT_ERRNO profile denies as expected
The libseccomp side is https://github.com/seccomp/libseccomp/pull/471,
and the tracking issue is https://github.com/sparclinux/issues/issues/11.
v2: drop the local regs-struct definition in the selftest in favour of
PTRACE_GETREGS64/PTRACE_SETREGS64 and the uapi struct pt_regs
(Kees Cook); patch 1 unchanged.
Stian Halseth (2):
sparc64: add seccomp filter support
selftests/seccomp: add sparc64 support
arch/sparc/Kconfig | 2 +-
arch/sparc/include/asm/seccomp.h | 15 ++++++++
arch/sparc/include/asm/syscall.h | 11 +++---
arch/sparc/kernel/entry.h | 2 +-
arch/sparc/kernel/ptrace_64.c | 28 ++++++++++-----
arch/sparc/kernel/syscalls.S | 28 +++++++++++----
tools/testing/selftests/seccomp/seccomp_bpf.c | 36 ++++++++++++++++++++
7 files changed, 99 insertions(+), 23 deletions(-)
--
2.45
