On Wed, Sep 30, 2020 at 10:19:12AM -0500, YiFei Zhu wrote: > From: Kees Cook <keescook@xxxxxxxxxxxx> > > Provide seccomp internals with the details to calculate which syscall > table the running kernel is expecting to deal with. This allows for > efficient architecture pinning and paves the way for constant-action > bitmaps. > > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> > [YiFei: Removed x32, added macro for nr_syscalls] > Signed-off-by: YiFei Zhu <yifeifz2@xxxxxxxxxxxx> > --- > arch/x86/include/asm/seccomp.h | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > > diff --git a/arch/x86/include/asm/seccomp.h b/arch/x86/include/asm/seccomp.h > index 2bd1338de236..7b3a58271656 100644 > --- a/arch/x86/include/asm/seccomp.h > +++ b/arch/x86/include/asm/seccomp.h > @@ -16,6 +16,18 @@ > #define __NR_seccomp_sigreturn_32 __NR_ia32_sigreturn > #endif > > +#ifdef CONFIG_X86_64 > +# define SECCOMP_ARCH_DEFAULT AUDIT_ARCH_X86_64 > +# define SECCOMP_ARCH_DEFAULT_NR NR_syscalls bikeshedding: let's call these SECCOMP_ARCH_NATIVE* -- I think it's more descriptive. > +# ifdef CONFIG_COMPAT > +# define SECCOMP_ARCH_COMPAT AUDIT_ARCH_I386 > +# define SECCOMP_ARCH_COMPAT_NR IA32_NR_syscalls > +# endif > +#else /* !CONFIG_X86_64 */ > +# define SECCOMP_ARCH_DEFAULT AUDIT_ARCH_I386 > +# define SECCOMP_ARCH_DEFAULT_NR NR_syscalls > +#endif > + > #include <asm-generic/seccomp.h> > > #endif /* _ASM_X86_SECCOMP_H */ > -- > 2.28.0 > But otherwise, yes, looks good to me. For this patch, I think the S-o-b chain is probably more accurately captured as: Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> Co-developed-by: YiFei Zhu <yifeifz2@xxxxxxxxxxxx> Signed-off-by: YiFei Zhu <yifeifz2@xxxxxxxxxxxx> -- Kees Cook
