Commit graph

5 commits

Author SHA1 Message Date
Jerry Zhang
8dc4ef98ff Allow io_* syscalls.
Bug: 37916658
Bug: 31712568
Test: Use the syscalls, verify not seccomp blocked
Change-Id: Iae19003cc5ff7e3d00cfc2237420f370fba7e289
2017-07-14 11:14:49 -07:00
Josh Gao
de9262e5c5 Add syscalls that aren't currently used to the seccomp whitelist.
Add some useful new syscalls that we currently aren't using in bionic,
but might in the future to the seccomp whitelist.

Bug: http://b/37317198
Test: mma
Change-Id: I6550867da152cea84fb13d0c15a399cdb2acf1aa
2017-04-19 13:45:47 -07:00
Paul Lawrence
3dd3d55af2 Add seccomp blacklist, and exclude swap functions
Bug: 37253880
Test: Make sure device boots
      Run pylint on genseccomp.py, test_genseccomp.py
      Run test_genseccomp.py
      Run new CTS test
      cts-tradefed run cts -m CtsSecurityTestCases -t android.security.cts.SeccompTest

Change-Id: I833a5364a1481d65173e77654da1798dc45a3f9d
2017-04-12 19:34:33 +00:00
Paul Lawrence
65b47c9fe0 Fix problem that we don't block syscalls below min value
The check that we are not below the lowest permitted syscall was
off by one, so we always allowed them, rather than always denying
them

Test: Check arm64 boots, chrome and maps work
      mips and mips64 emulators boot
      Note that arm, x86 and x86_64 already allow syscall 0 so there
      will be no functional change there

Change-Id: I85873f1d04124e634e648bd47c027f280f1d6dbd
2017-03-22 09:48:17 -07:00
Paul Lawrence
89fa81fda3 Support all architectures in seccomp
Test: Make sure arm, x86, x86_64, mips, mips64 emulators boot
      Make sure sailfish still boots
      Ran CTS test from
      https://android-review.googlesource.com/#/c/348671/3 and it passed
      The instructions for how to run mips emulators above worked, but
      the CTS tests did not seem to actually run.

Change-Id: Iddee5acdb19ed32c7bd4657573313ca439cf6a49
2017-03-13 18:26:50 +00:00