Re: Seccomp support for linux-m68k
Hi Adrian,
Am 22.07.2020 um 03:13 schrieb John Paul Adrian Glaubitz:
Hello!
On 3/20/20 9:46 AM, John Paul Adrian Glaubitz wrote:
Would it be possible to add seccomp support for m68k in the kernel?
There are some packages like kscreensaver in Debian that require
libseccomp-dev and it would therefore be desirable if we could
that library on Linux/m68k as well.
>From what I have learned from Helge Deller who added seccomp for
hppa, it doesn't seem much that is necessary to get seccomp working
on an architecture.
So, if anyone could work on the kernel part, I could do the work on
libseccomp.
I just had another look at the topic and it seems with just need a minimal
patch to add SECCOMP and SECCOMP_FILTER support when looking at the changes
for riscv64 [1].
The most complex change seem to be the changes in entry.S to add some additional
checks for syscall numbers. I think we could just do this for m68k (and SH) as
well.
Looking at your SH patch, I see no changes to check for syscall numbers,
just a check of the syscall_trace_enter() return code added? Is that all
that's needed for m68k as well?
What return code would we need to set on returning from an aborted
syscall? (Without setting a specific one, -ENOSYS will be used by default.)
The userland land part is trivial as well, I actually added SuperH support to
libseccomp today which was rather easy but my pull request was rejected for the
time being due to SuperH not supporting SECCOMP_FILTER yet (only basic SECCOMP).
So, if someone could do the kernel pieces for m68k, I would work on the userspace
changes in libsseccomp.
My earlier patch switching m68k to use syscall_trace_enter() is
incomplete, please add the return call check
--- a/arch/m68k/kernel/entry.S
+++ b/arch/m68k/kernel/entry.S
@@ -167,6 +167,8 @@ do_trace_entry:
jbsr syscall_trace_enter
RESTORE_SWITCH_STACK
addql #4,%sp
+ tstb %d0
+ jne ret_from_syscall
movel %sp@(PT_OFF_ORIG_D0),%d0
cmpl #NR_syscalls,%d0
jcs syscall
and add the same seccomp check you used in the SH syscall_trace_enter()
patch, if returning -ENOSYS on filtered syscalls is appropriate.
Cheers,
Michael
Adrian
[1] https://github.com/torvalds/linux/commit/5340627e3fe08030988bdda46dd86cd5d5fb7517
[2] https://github.com/seccomp/libseccomp/pull/271
Reply to: