[PATCH v5 3/7] seccomp: add __NR_seccomp_* aliases for rt_sigreturn and clone/fork

[Cong Wang]

From: Cong Wang <cwang@xxxxxxxxxxxxxx>

The existing __NR_seccomp_* aliases name only the syscalls strict mode
allows (read/write/exit/sigreturn). SEND_REDIRECT needs to recognise a
few more so it can refuse to redirect them; add aliases for those,
following the same arch-overridable pattern that keeps arch-specific
numbers out of generic seccomp code:

  - __NR_seccomp_rt_sigreturn{,_32}: sigreturn and rt_sigreturn are
    distinct numbers on 32-bit/compat, so both must be nameable. The
    generic default aliases rt_sigreturn to the plain sigreturn number,
    a harmless duplicate on arches that do not distinguish the two.

  - __NR_seccomp_clone{,3}{,_32}, __NR_seccomp_{,v}fork{,_32}: the
    task-creation family. An arch lacking a syscall, or without a
    distinct compat number, maps it to -1, which is never a valid
    syscall number and so never matches.

x86 supplies the ia32 compat numbers. No functional change; the aliases
are consumed by the SEND_REDIRECT denylist in a later commit.

Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Cong Wang <cwang@xxxxxxxxxxxxxx>
---
 arch/x86/include/asm/seccomp.h |  6 +++++
 include/asm-generic/seccomp.h  | 45 ++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)

diff --git a/arch/x86/include/asm/seccomp.h b/arch/x86/include/asm/seccomp.h
index 42bcd42d70d1..c95c00b8927c 100644
--- a/arch/x86/include/asm/seccomp.h
+++ b/arch/x86/include/asm/seccomp.h
@@ -6,6 +6,7 @@
 
 #ifdef CONFIG_X86_32
 #define __NR_seccomp_sigreturn		__NR_sigreturn
+#define __NR_seccomp_rt_sigreturn	__NR_rt_sigreturn
 #endif
 
 #ifdef CONFIG_COMPAT
@@ -14,6 +15,11 @@
 #define __NR_seccomp_write_32		__NR_ia32_write
 #define __NR_seccomp_exit_32		__NR_ia32_exit
 #define __NR_seccomp_sigreturn_32	__NR_ia32_sigreturn
+#define __NR_seccomp_rt_sigreturn_32	__NR_ia32_rt_sigreturn
+#define __NR_seccomp_clone_32		__NR_ia32_clone
+#define __NR_seccomp_clone3_32		__NR_ia32_clone3
+#define __NR_seccomp_fork_32		__NR_ia32_fork
+#define __NR_seccomp_vfork_32		__NR_ia32_vfork
 #endif
 
 #ifdef CONFIG_X86_64
diff --git a/include/asm-generic/seccomp.h b/include/asm-generic/seccomp.h
index 6b6f42bc58f9..3c63ce888225 100644
--- a/include/asm-generic/seccomp.h
+++ b/include/asm-generic/seccomp.h
@@ -25,6 +25,51 @@
 #ifndef __NR_seccomp_sigreturn
 #define __NR_seccomp_sigreturn		__NR_rt_sigreturn
 #endif
+#if defined(CONFIG_COMPAT) && !defined(__NR_seccomp_rt_sigreturn_32)
+#define __NR_seccomp_rt_sigreturn_32	__NR_seccomp_sigreturn_32
+#endif
+#ifndef __NR_seccomp_rt_sigreturn
+#define __NR_seccomp_rt_sigreturn	__NR_seccomp_sigreturn
+#endif
+
+#ifndef __NR_seccomp_clone
+#define __NR_seccomp_clone		__NR_clone
+#endif
+#ifndef __NR_seccomp_clone3
+#ifdef __NR_clone3
+#define __NR_seccomp_clone3		__NR_clone3
+#else
+#define __NR_seccomp_clone3		(-1)
+#endif
+#endif
+#ifndef __NR_seccomp_fork
+#ifdef __NR_fork
+#define __NR_seccomp_fork		__NR_fork
+#else
+#define __NR_seccomp_fork		(-1)
+#endif
+#endif
+#ifndef __NR_seccomp_vfork
+#ifdef __NR_vfork
+#define __NR_seccomp_vfork		__NR_vfork
+#else
+#define __NR_seccomp_vfork		(-1)
+#endif
+#endif
+#ifdef CONFIG_COMPAT
+#ifndef __NR_seccomp_clone_32
+#define __NR_seccomp_clone_32		(-1)
+#endif
+#ifndef __NR_seccomp_clone3_32
+#define __NR_seccomp_clone3_32		(-1)
+#endif
+#ifndef __NR_seccomp_fork_32
+#define __NR_seccomp_fork_32		(-1)
+#endif
+#ifndef __NR_seccomp_vfork_32
+#define __NR_seccomp_vfork_32		(-1)
+#endif
+#endif /* CONFIG_COMPAT */
 
 #ifdef CONFIG_COMPAT
 #ifndef get_compat_mode1_syscalls
-- 
2.43.0