Commit 6baaade1 authored by Michael Schmitz's avatar Michael Schmitz Committed by Geert Uytterhoeven
Browse files

m68k: Add kernel seccomp support 



Add secure_computing() call to syscall_trace_enter to actually
filter system calls.

Add necessary arch Kconfig options, define TIF_SECCOMP trace
flag and provide basic seccomp filter support in asm/syscall.h

syscall_get_nr currently uses the syscall nr stored in orig_d0
because we change d0 to a default return code before starting a
syscall trace. This may be inconsistent with syscall_rollback
copying orig_d0 to d0 (which we never check upon return from
trace). We use d0 for the return code from syscall_trace_enter
in entry.S currently, and could perhaps expand that to store
a new syscall number returned by the seccomp filter before
executing the syscall. This clearly needs some discussion.

seccomp_bpf self test on ARAnyM passes 81 out of 94 tests.

Signed-off-by: default avatarMichael Schmitz <schmitzmic@gmail.com>
Reviewed-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/r/20230112035529.13521-3-schmitzmic@gmail.com


Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
parent 2ca8a1de

Documentation/features/seccomp/seccomp-filter/arch-support.txt

+1 −1
Original line number Diff line number Diff line
@@ -14,7 +14,7 @@ 
    |     hexagon: | TODO |

    |        ia64: | TODO |

    |   loongarch: |  ok  |

    |        m68k: | TODO |

    |        m68k: |  ok  |

    |  microblaze: | TODO |

    |        mips: |  ok  |

    |       nios2: | TODO |

arch/m68k/Kconfig

+2 −0
Original line number Diff line number Diff line
@@ -18,6 +18,8 @@ config M68K 
	select GENERIC_CPU_DEVICES

	select GENERIC_IOMAP

	select GENERIC_IRQ_SHOW

	select HAVE_ARCH_SECCOMP

	select HAVE_ARCH_SECCOMP_FILTER

	select HAVE_ASM_MODVERSIONS

	select HAVE_DEBUG_BUGVERBOSE

	select HAVE_EFFICIENT_UNALIGNED_ACCESS if !CPU_HAS_NO_UNALIGNED

arch/m68k/include/asm/seccomp.h

0 → 100644
+11 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0-only */

#ifndef _ASM_SECCOMP_H

#define _ASM_SECCOMP_H



#include <asm-generic/seccomp.h>



#define SECCOMP_ARCH_NATIVE		AUDIT_ARCH_M68K

#define SECCOMP_ARCH_NATIVE_NR		NR_syscalls

#define SECCOMP_ARCH_NATIVE_NAME	"m68k"



#endif /* _ASM_SECCOMP_H */

arch/m68k/include/asm/syscall.h

+57 −0
Original line number Diff line number Diff line
@@ -4,6 +4,63 @@ 


#include <uapi/linux/audit.h>



#include <asm/unistd.h>



extern const unsigned long sys_call_table[];



static inline int syscall_get_nr(struct task_struct *task,

				 struct pt_regs *regs)

{

	return regs->orig_d0;

}



static inline void syscall_rollback(struct task_struct *task,

				    struct pt_regs *regs)

{

	regs->d0 = regs->orig_d0;

}



static inline long syscall_get_error(struct task_struct *task,

				     struct pt_regs *regs)

{

	unsigned long error = regs->d0;



	return IS_ERR_VALUE(error) ? error : 0;

}



static inline long syscall_get_return_value(struct task_struct *task,

					    struct pt_regs *regs)

{

	return regs->d0;

}



static inline void syscall_set_return_value(struct task_struct *task,

					    struct pt_regs *regs,

					    int error, long val)

{

	regs->d0 = (long)error ?: val;

}



static inline void syscall_get_arguments(struct task_struct *task,

					 struct pt_regs *regs,

					 unsigned long *args)

{

	args[0] = regs->orig_d0;

	args++;



	memcpy(args, &regs->d1, 5 * sizeof(args[0]));

}



static inline void syscall_set_arguments(struct task_struct *task,

					 struct pt_regs *regs,

					 unsigned long *args)

{

	regs->orig_d0 = args[0];

	args++;



	memcpy(&regs->d1, args, 5 * sizeof(args[0]));

}



static inline int syscall_get_arch(struct task_struct *task)

{

	return AUDIT_ARCH_M68K;

arch/m68k/include/asm/thread_info.h

+2 −0
Original line number Diff line number Diff line
@@ -61,6 +61,7 @@ static inline struct thread_info *current_thread_info(void) 
#define TIF_NOTIFY_RESUME	5	/* callback before returning to user */

#define TIF_SIGPENDING		6	/* signal pending */

#define TIF_NEED_RESCHED	7	/* rescheduling necessary */

#define TIF_SECCOMP		13	/* seccomp syscall filtering active */

#define TIF_DELAYED_TRACE	14	/* single step a syscall */

#define TIF_SYSCALL_TRACE	15	/* syscall trace active */

#define TIF_MEMDIE		16	/* is terminating due to OOM killer */
@@ -69,6 +70,7 @@ static inline struct thread_info *current_thread_info(void) 
#define _TIF_NOTIFY_RESUME	(1 << TIF_NOTIFY_RESUME)

#define _TIF_SIGPENDING		(1 << TIF_SIGPENDING)

#define _TIF_NEED_RESCHED	(1 << TIF_NEED_RESCHED)

#define _TIF_SECCOMP		(1 << TIF_SECCOMP)

#define _TIF_DELAYED_TRACE	(1 << TIF_DELAYED_TRACE)

#define _TIF_SYSCALL_TRACE	(1 << TIF_SYSCALL_TRACE)

#define _TIF_MEMDIE		(1 << TIF_MEMDIE)