[PATCH v17 00/15] seccomp_filter: BPF-based syscall filtering

[Will Drewry <wad@chromium.org>]

Please see prior revisions for a detailed discussion of this patch
series.

This series is a rebase on to:
  b5174fa3a7f4f8f150bfa3b917c92608953dfa0f
with very minor changes due to rebasing and tweaks noticed by a few
initial users.  (I will rebase again for v3.4-rc1 when that time comes.)

I realize now is a noisy time, but I wanted to get the most current
revision on the list.

As per prior posts, I am now including luto@'s PR_SET_NO_NEW_PRIVS
changes in the series for clarity and ease of testing.  This latest
rebased required required bumping the prctl() numbers for the
NO_NEW_PRIVS work due to the new reaper options.

For those inclined, the whole series can be found here too:
   https://github.com/redpig/linux/tree/seccomp

At this point, I'm not aware of any outstanding concerns, complaints,
etc. If there are any, I'd love to know.

Thanks!
will


Andy Lutomirski (1):
  Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs

John Johansen (1):
  Fix apparmor for PR_{GET,SET}_NO_NEW_PRIVS

Kees Cook (1):
  seccomp: remove duplicated failure logging

Will Drewry (12):
  sk_run_filter: add BPF_S_ANC_SECCOMP_LD_W
  net/compat.c,linux/filter.h: share compat_sock_fprog
  seccomp: kill the seccomp_t typedef
  arch/x86: add syscall_get_arch to syscall.h
  asm/syscall.h: add syscall_get_arch
  seccomp: add system call filtering using BPF
  seccomp: add SECCOMP_RET_ERRNO
  signal, x86: add SIGSYS info and make it synchronous.
  seccomp: Add SECCOMP_RET_TRAP
  ptrace,seccomp: Add PTRACE_SECCOMP support
  x86: Enable HAVE_ARCH_SECCOMP_FILTER
  Documentation: prctl/seccomp_filter

 Documentation/prctl/seccomp_filter.txt |  163 ++++++++++++
 arch/Kconfig                           |   24 ++
 arch/x86/Kconfig                       |    1 +
 arch/x86/ia32/ia32_signal.c            |    4 +
 arch/x86/include/asm/ia32.h            |    6 +
 arch/x86/include/asm/syscall.h         |   23 ++
 arch/x86/kernel/ptrace.c               |    7 +-
 fs/exec.c                              |   10 +-
 include/asm-generic/siginfo.h          |   22 ++
 include/asm-generic/syscall.h          |   14 +
 include/linux/Kbuild                   |    1 +
 include/linux/audit.h                  |    8 +-
 include/linux/filter.h                 |   12 +
 include/linux/prctl.h                  |   15 +
 include/linux/ptrace.h                 |    5 +-
 include/linux/sched.h                  |    4 +-
 include/linux/seccomp.h                |  105 +++++++-
 include/linux/security.h               |    1 +
 kernel/auditsc.c                       |   10 +-
 kernel/fork.c                          |    3 +
 kernel/seccomp.c                       |  447 ++++++++++++++++++++++++++++++--
 kernel/signal.c                        |    9 +-
 kernel/sys.c                           |   12 +-
 net/compat.c                           |    8 -
 net/core/filter.c                      |    6 +
 samples/Makefile                       |    2 +-
 samples/seccomp/Makefile               |   38 +++
 samples/seccomp/bpf-direct.c           |  176 +++++++++++++
 samples/seccomp/bpf-fancy.c            |  102 ++++++++
 samples/seccomp/bpf-helper.c           |   89 +++++++
 samples/seccomp/bpf-helper.h           |  238 +++++++++++++++++
 samples/seccomp/dropper.c              |   68 +++++
 security/apparmor/domain.c             |   35 +++
 security/commoncap.c                   |    7 +-
 security/selinux/hooks.c               |   10 +-
 35 files changed, 1628 insertions(+), 57 deletions(-)
 create mode 100644 Documentation/prctl/seccomp_filter.txt
 create mode 100644 samples/seccomp/Makefile
 create mode 100644 samples/seccomp/bpf-direct.c
 create mode 100644 samples/seccomp/bpf-fancy.c
 create mode 100644 samples/seccomp/bpf-helper.c
 create mode 100644 samples/seccomp/bpf-helper.h
 create mode 100644 samples/seccomp/dropper.c

-- 
1.7.5.4