From: Kees Cook <keescook@chromium.org>
To: akpm@linux-foundation.org, sfr@canb.auug.org.au
Cc: Will Drewry <wad@chromium.org>,
linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org,
linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com,
netdev@vger.kernel.org, x86@kernel.org, arnd@arndb.de,
davem@davemloft.net, hpa@zytor.com, mingo@redhat.com,
oleg@redhat.com, peterz@infradead.org, rdunlap@xenotime.net,
mcgrathr@chromium.org, tglx@linutronix.de, luto@mit.edu,
eparis@redhat.com, serge.hallyn@canonical.com, djm@mindrot.org,
scarybeasts@gmail.com, indan@nul.nu, pmoore@redhat.com,
corbet@lwn.net, eric.dumazet@gmail.com, markus@chromium.org,
coreyb@linux.vnet.ibm.com
Subject: Re: [PATCH v12 01/13] sk_run_filter: add support for custom load_pointer
Date: Thu, 1 Mar 2012 15:37:12 -0800 [thread overview]
Message-ID: <20120301233712.GS3990@outflux.net> (raw)
In-Reply-To: <1330559620-23543-1-git-send-email-wad@chromium.org>
Hi,
So far, it looks like everyone who spoke up is satisfied with this patch
series. Or their MUAs got caught up on a leap-year bug and missed the
posting. ;)
Is it time to pull this into -next so more people can feel it? I brought
Andy Lutomirski's patches forward (needed to bump the prctl values), and
updated my git tree. If we're ready, here it is in all its request-pull
format glory:
The following changes since commit 2422c8368337196594265d52cad7316c9404bfcf:
Stephen Rothwell (1):
Add linux-next specific files for 20120301
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git seccomp
Andy Lutomirski (1):
Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs
John Johansen (1):
Fix apparmor for PR_{GET,SET}_NO_NEW_PRIVS
Kees Cook (1):
seccomp: remove duplicated failure logging
Will Drewry (12):
sk_run_filter: add support for custom load_pointer
net/compat.c,linux/filter.h: share compat_sock_fprog
seccomp: kill the seccomp_t typedef
asm/syscall.h: add syscall_get_arch
arch/x86: add syscall_get_arch to syscall.h
seccomp: add system call filtering using BPF
seccomp: add SECCOMP_RET_ERRNO
signal, x86: add SIGSYS info and make it synchronous.
seccomp: Add SECCOMP_RET_TRAP
ptrace,seccomp: Add PTRACE_SECCOMP support
x86: Enable HAVE_ARCH_SECCOMP_FILTER
Documentation: prctl/seccomp_filter
Documentation/prctl/seccomp_filter.txt | 156 +++++++++++++
arch/Kconfig | 24 ++
arch/x86/Kconfig | 1 +
arch/x86/ia32/ia32_signal.c | 4 +
arch/x86/include/asm/ia32.h | 6 +
arch/x86/include/asm/syscall.h | 23 ++
arch/x86/kernel/ptrace.c | 7 +-
fs/exec.c | 10 +-
include/asm-generic/siginfo.h | 22 ++
include/asm-generic/syscall.h | 14 ++
include/linux/Kbuild | 1 +
include/linux/audit.h | 8 +-
include/linux/filter.h | 57 +++++
include/linux/prctl.h | 15 ++
include/linux/ptrace.h | 5 +-
include/linux/sched.h | 4 +-
include/linux/seccomp.h | 99 +++++++-
include/linux/security.h | 1 +
kernel/auditsc.c | 9 +-
kernel/fork.c | 3 +
kernel/seccomp.c | 378 ++++++++++++++++++++++++++++++--
kernel/signal.c | 9 +-
kernel/sys.c | 12 +-
net/compat.c | 8 -
net/core/filter.c | 117 ++++++++++-
samples/Makefile | 2 +-
samples/seccomp/Makefile | 38 ++++
samples/seccomp/bpf-direct.c | 176 +++++++++++++++
samples/seccomp/bpf-fancy.c | 102 +++++++++
samples/seccomp/bpf-helper.c | 89 ++++++++
samples/seccomp/bpf-helper.h | 238 ++++++++++++++++++++
samples/seccomp/dropper.c | 68 ++++++
security/apparmor/domain.c | 35 +++
security/commoncap.c | 7 +-
security/selinux/hooks.c | 10 +-
35 files changed, 1695 insertions(+), 63 deletions(-)
create mode 100644 Documentation/prctl/seccomp_filter.txt
create mode 100644 samples/seccomp/Makefile
create mode 100644 samples/seccomp/bpf-direct.c
create mode 100644 samples/seccomp/bpf-fancy.c
create mode 100644 samples/seccomp/bpf-helper.c
create mode 100644 samples/seccomp/bpf-helper.h
create mode 100644 samples/seccomp/dropper.c
--
Kees Cook
ChromeOS Security
next prev parent reply other threads:[~2012-03-01 23:37 UTC|newest]
Thread overview: 73+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-02-29 23:53 [PATCH v12 01/13] sk_run_filter: add support for custom load_pointer Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-02-29 23:53 ` [PATCH v12 02/13] net/compat.c,linux/filter.h: share compat_sock_fprog Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-02-29 23:53 ` [PATCH v12 03/13] seccomp: kill the seccomp_t typedef Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-02-29 23:53 ` [PATCH v12 04/13] asm/syscall.h: add syscall_get_arch Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-02-29 23:53 ` [PATCH v12 05/13] arch/x86: add syscall_get_arch to syscall.h Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-02-29 23:53 ` [PATCH v12 06/13] seccomp: add system call filtering using BPF Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-03-02 5:45 ` Indan Zupancic
2012-03-02 5:45 ` Indan Zupancic
2012-03-02 5:52 ` H. Peter Anvin
2012-03-02 5:52 ` H. Peter Anvin
2012-03-02 6:43 ` Indan Zupancic
2012-03-02 6:43 ` Indan Zupancic
2012-03-02 6:55 ` H. Peter Anvin
2012-03-02 6:55 ` H. Peter Anvin
2012-03-02 8:12 ` Indan Zupancic
2012-03-02 8:12 ` Indan Zupancic
2012-03-02 18:44 ` [kernel-hardening] " Will Drewry
2012-03-02 18:44 ` Will Drewry
2012-02-29 23:53 ` [PATCH v12 07/13] seccomp: add SECCOMP_RET_ERRNO Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-03-02 18:24 ` Serge E. Hallyn
2012-03-02 18:24 ` Serge E. Hallyn
2012-03-05 21:03 ` Will Drewry
2012-03-05 21:03 ` Will Drewry
2012-03-05 21:13 ` Serge Hallyn
2012-03-05 21:13 ` Serge Hallyn
2012-02-29 23:53 ` [PATCH v12 08/13] signal, x86: add SIGSYS info and make it synchronous Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-02-29 23:53 ` [PATCH v12 09/13] seccomp: Add SECCOMP_RET_TRAP Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-02-29 23:53 ` [PATCH v12 10/13] ptrace,seccomp: Add PTRACE_SECCOMP support Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-02-29 23:53 ` [PATCH v12 11/13] x86: Enable HAVE_ARCH_SECCOMP_FILTER Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-02-29 23:53 ` [PATCH v12 12/13] Documentation: prctl/seccomp_filter Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-02-29 23:53 ` [PATCH v12 13/13] seccomp: remove duplicated failure logging Will Drewry
2012-02-29 23:53 ` Will Drewry
2012-03-01 23:37 ` Kees Cook [this message]
2012-03-01 23:37 ` [PATCH v12 01/13] sk_run_filter: add support for custom load_pointer Kees Cook
2012-03-02 0:05 ` H. Peter Anvin
2012-03-02 0:05 ` H. Peter Anvin
2012-03-02 0:22 ` Andrew Lutomirski
2012-03-02 0:47 ` Stephen Rothwell
2012-03-02 0:47 ` Stephen Rothwell
2012-03-02 0:57 ` Kees Cook
2012-03-02 1:19 ` Andrew Morton
2012-03-02 1:19 ` Andrew Morton
2012-03-02 2:39 ` Will Drewry
2012-03-02 2:39 ` Will Drewry
2012-03-02 4:04 ` Indan Zupancic
2012-03-02 4:04 ` Indan Zupancic
2012-03-02 5:03 ` Stephen Rothwell
2012-03-02 5:03 ` Stephen Rothwell
2012-03-02 5:26 ` Kees Cook
2012-03-02 5:26 ` Kees Cook
2012-03-02 1:48 ` Andrew Lutomirski
2012-03-02 3:10 ` Stephen Rothwell
2012-03-02 3:41 ` Will Drewry
2012-03-02 3:41 ` Will Drewry
2012-03-02 3:57 ` Stephen Rothwell
2012-03-02 3:57 ` Stephen Rothwell
2012-03-02 0:47 ` Eric Dumazet
2012-03-02 10:40 ` Indan Zupancic
2012-03-02 10:40 ` Indan Zupancic
2012-03-02 18:47 ` Will Drewry
2012-03-02 18:47 ` Will Drewry
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120301233712.GS3990@outflux.net \
--to=keescook@chromium.org \
--cc=akpm@linux-foundation.org \
--cc=arnd@arndb.de \
--cc=corbet@lwn.net \
--cc=coreyb@linux.vnet.ibm.com \
--cc=davem@davemloft.net \
--cc=djm@mindrot.org \
--cc=eparis@redhat.com \
--cc=eric.dumazet@gmail.com \
--cc=hpa@zytor.com \
--cc=indan@nul.nu \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@mit.edu \
--cc=markus@chromium.org \
--cc=mcgrathr@chromium.org \
--cc=mingo@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=oleg@redhat.com \
--cc=peterz@infradead.org \
--cc=pmoore@redhat.com \
--cc=rdunlap@xenotime.net \
--cc=scarybeasts@gmail.com \
--cc=serge.hallyn@canonical.com \
--cc=sfr@canb.auug.org.au \
--cc=tglx@linutronix.de \
--cc=wad@chromium.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).