Re: [PATCH] seccomp: Stub for !HAVE_ARCH_SECCOMP_FILTER

[Kees Cook <kees@kernel.org>]

On Tue, Oct 08, 2024 at 10:29:43AM +0200, Linus Walleij wrote:
> If we have CONFIG_SECCOMP but not CONFIG_HAVE_ARCH_SECCOMP_FILTER
> we get a compilation error:
> [...]
> +static inline int __secure_computing(const struct seccomp_data *sd) { return 0; }

I don't think this is the right solution (for gaining ARM generic
syscall support). For example see how this is done currently on ARM:

#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
        if (secure_computing() == -1)
                return -1;
#else
        /* XXX: remove this once OABI gets fixed */
        secure_computing_strict(syscall_get_nr(current, regs));
#endif

If we just return 0, all of seccomp will get ignored. I think the
generic code needs to do something like the above...

-- 
Kees Cook