tequilaOS/platform_bionic
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Use trap not kill in seccomp filter

Browse source 
Bug: 34647665
Test: Make sure boots, check that causing a seccomp failure creates a
      crash dump

Change-Id: I5ab2fe3e8322a3c38318c97d343834baa874af8d
This commit is contained in:
Paul Lawrence 2017-01-24 10:44:55 -08:00
parent 7844b4c5db
commit 3d9fc696a5
3 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
libc/seccomp/arm64_policy.c
View file

@ -41,7 +41,7 @@ BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, 262, 3, 4), //wait4|prlimit64
BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, 268, 1, 0),
BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, 267, 1, 2), //clock_adjtime
BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, 272, 0, 1), //setns|sendmmsg|process_vm_readv|process_vm_writev
BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
};

2
libc/seccomp/arm_policy.c
View file

@ -139,7 +139,7 @@ BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, 378, 3, 4), //sendmmsg|setns|process_vm_readv|pr
BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, 983045, 1, 0),
BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, 983043, 1, 2), //__ARM_NR_cacheflush
BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, 983046, 0, 1), //__ARM_NR_set_tls
BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
};

2
libc/tools/genseccomp.py
View file

@ -126,7 +126,7 @@ def construct_bpf(architecture, header_dir, output_path):
", 0, " + str(len(bpf)) + "),")
# Add the error and allow calls at the end
bpf.append("BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),")
bpf.append("BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),")
bpf.append("BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),")
# And output policy