[RFC PATCH 2/9] seccomp: add __NR_seccomp_* aliases for the fork family

[Cong Wang]

From: Cong Wang <cwang@xxxxxxxxxxxxxx>

The existing __NR_seccomp_* aliases name only the strict mode syscalls
(read, write, exit, sigreturn). Add aliases for the task creation
family, clone, clone3, fork and vfork, so that seccomp can recognise
those syscalls by number, natively and for compat tasks.

The native aliases get generic defaults from <asm/unistd.h>. A syscall
the arch does not have is named -1, which never matches a valid syscall
number.

The compat aliases have no generic default, because a wrong compat
number cannot be told from a right one. An arch provides them when it
wants compat tasks covered; x86 does so for ia32. x32 needs nothing:
its syscall numbers carry __X32_SYSCALL_BIT and match none of the
native aliases.

Signed-off-by: Cong Wang <cwang@xxxxxxxxxxxxxx>
---
 arch/Kconfig                   |  6 ++++++
 arch/x86/include/asm/seccomp.h |  4 ++++
 include/asm-generic/seccomp.h  | 26 ++++++++++++++++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/arch/Kconfig b/arch/Kconfig
index 45c657772362..61040529a7da 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -641,6 +641,12 @@ config HAVE_ARCH_SECCOMP
 	  - __NR_seccomp_write_32
 	  - __NR_seccomp_exit_32
 	  - __NR_seccomp_sigreturn_32
+	  and, optionally, the compat fork family, for features that need to
+	  recognise it (there is no generic default for these):
+	  - __NR_seccomp_clone_32
+	  - __NR_seccomp_clone3_32
+	  - __NR_seccomp_fork_32
+	  - __NR_seccomp_vfork_32
 
 config HAVE_ARCH_SECCOMP_FILTER
 	bool
diff --git a/arch/x86/include/asm/seccomp.h b/arch/x86/include/asm/seccomp.h
index 42bcd42d70d1..767d047050a1 100644
--- a/arch/x86/include/asm/seccomp.h
+++ b/arch/x86/include/asm/seccomp.h
@@ -14,6 +14,10 @@
 #define __NR_seccomp_write_32		__NR_ia32_write
 #define __NR_seccomp_exit_32		__NR_ia32_exit
 #define __NR_seccomp_sigreturn_32	__NR_ia32_sigreturn
+#define __NR_seccomp_clone_32		__NR_ia32_clone
+#define __NR_seccomp_clone3_32		__NR_ia32_clone3
+#define __NR_seccomp_fork_32		__NR_ia32_fork
+#define __NR_seccomp_vfork_32		__NR_ia32_vfork
 #endif
 
 #ifdef CONFIG_X86_64
diff --git a/include/asm-generic/seccomp.h b/include/asm-generic/seccomp.h
index 6b6f42bc58f9..5acdeb62c56c 100644
--- a/include/asm-generic/seccomp.h
+++ b/include/asm-generic/seccomp.h
@@ -26,6 +26,32 @@
 #define __NR_seccomp_sigreturn		__NR_rt_sigreturn
 #endif
 
+/* The fork family; -1 names a syscall the arch does not have. */
+#ifndef __NR_seccomp_clone
+#define __NR_seccomp_clone		__NR_clone
+#endif
+#ifndef __NR_seccomp_clone3
+#ifdef __NR_clone3
+#define __NR_seccomp_clone3		__NR_clone3
+#else
+#define __NR_seccomp_clone3		(-1)
+#endif
+#endif
+#ifndef __NR_seccomp_fork
+#ifdef __NR_fork
+#define __NR_seccomp_fork		__NR_fork
+#else
+#define __NR_seccomp_fork		(-1)
+#endif
+#endif
+#ifndef __NR_seccomp_vfork
+#ifdef __NR_vfork
+#define __NR_seccomp_vfork		__NR_vfork
+#else
+#define __NR_seccomp_vfork		(-1)
+#endif
+#endif
+
 #ifdef CONFIG_COMPAT
 #ifndef get_compat_mode1_syscalls
 static inline const int *get_compat_mode1_syscalls(void)
-- 
2.43.0