[GIT PULL] seccomp updates for v5.10-rc1
From: Kees Cook
Date: Mon Oct 12 2020 - 18:17:23 EST
Hi Linus,
Please pull these seccomp updates for v5.10-rc1. The bulk of the changes
are with the seccomp selftests to accommodate some powerpc-specific
behavioral characteristics. Additional cleanups, fixes, and improvements
are also included, noted in the tag description.
Thanks!
-Kees
The following changes since commit e839317900e9f13c83d8711d684de88c625b307a:
seccomp: don't leave dangling ->notif if file allocation fails (2020-09-08 11:30:16 -0700)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/seccomp-v5.10-rc1
for you to fetch changes up to dfe719fef03d752f1682fa8aeddf30ba501c8555:
seccomp: Make duplicate listener detection non-racy (2020-10-08 13:17:47 -0700)
----------------------------------------------------------------
seccomp updates for v5.10-rc1
- heavily refactor seccomp selftests (and clone3 selftests dependency) to
fix powerpc (Kees Cook, Thadeu Lima de Souza Cascardo)
- fix style issue in selftests (Zou Wei)
- upgrade "unknown action" from KILL_THREAD to KILL_PROCESS (Rich Felker)
- replace task_pt_regs(current) with current_pt_regs() (Denis Efremov)
- fix corner-case race in USER_NOTIF (Jann Horn)
- make CONFIG_SECCOMP no longer per-arch (YiFei Zhu)
----------------------------------------------------------------
Denis Efremov (1):
seccomp: Use current_pt_regs() instead of task_pt_regs(current)
Jann Horn (1):
seccomp: Make duplicate listener detection non-racy
Kees Cook (18):
selftests/seccomp: Add test for unknown SECCOMP_RET kill behavior
selftests/seccomp: Use __NR_mknodat instead of __NR_mknod
selftests/seccomp: Refactor arch register macros to avoid xtensa special case
selftests/seccomp: Provide generic syscall setting macro
selftests/seccomp: mips: Define SYSCALL_NUM_SET macro
selftests/seccomp: arm: Define SYSCALL_NUM_SET macro
selftests/seccomp: arm64: Define SYSCALL_NUM_SET macro
selftests/seccomp: mips: Remove O32-specific macro
selftests/seccomp: Remove syscall setting #ifdefs
selftests/seccomp: Convert HAVE_GETREG into ARCH_GETREG/ARCH_SETREG
selftests/seccomp: Convert REGSET calls into ARCH_GETREG/ARCH_SETREG
selftests/seccomp: Avoid redundant register flushes
selftests/seccomp: Remove SYSCALL_NUM_RET_SHARE_REG in favor of SYSCALL_RET_SET
selftests/seccomp: powerpc: Fix seccomp return value testing
selftests/seccomp: Record syscall during ptrace entry
selftests/seccomp: Allow syscall nr and ret value to be set separately
selftests/seccomp: powerpc: Set syscall return during ptrace syscall exit
selftests/clone3: Avoid OS-defined clone_args
Rich Felker (1):
seccomp: kill process instead of thread for unknown actions
YiFei Zhu (1):
seccomp: Move config option SECCOMP to arch/Kconfig
Zou Wei (1):
selftests/seccomp: Use bitwise instead of arithmetic operator for flags
arch/Kconfig | 30 ++
arch/arm/Kconfig | 15 +-
arch/arm64/Kconfig | 13 -
arch/csky/Kconfig | 13 -
arch/microblaze/Kconfig | 18 +-
arch/mips/Kconfig | 17 -
arch/parisc/Kconfig | 16 -
arch/powerpc/Kconfig | 17 -
arch/riscv/Kconfig | 13 -
arch/s390/Kconfig | 17 -
arch/sh/Kconfig | 16 -
arch/sparc/Kconfig | 18 +-
arch/um/Kconfig | 16 -
arch/x86/Kconfig | 16 -
arch/xtensa/Kconfig | 14 -
kernel/seccomp.c | 64 ++-
tools/testing/selftests/clone3/clone3.c | 45 +--
.../clone3/clone3_cap_checkpoint_restore.c | 4 +-
.../selftests/clone3/clone3_clear_sighand.c | 2 +-
tools/testing/selftests/clone3/clone3_selftests.h | 24 +-
tools/testing/selftests/clone3/clone3_set_tid.c | 4 +-
tools/testing/selftests/pidfd/pidfd_setns_test.c | 2 +-
tools/testing/selftests/seccomp/seccomp_bpf.c | 440 +++++++++++++--------
23 files changed, 397 insertions(+), 437 deletions(-)
--
Kees Cook