On Fri, Oct 9, 2020 at 10:15 AM YiFei Zhu <zhuyifei1999@xxxxxxxxx> wrote: > > From: Kees Cook <keescook@xxxxxxxxxxxx> > > Provide seccomp internals with the details to calculate which syscall > table the running kernel is expecting to deal with. This allows for > efficient architecture pinning and paves the way for constant-action > bitmaps. > > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> > Co-developed-by: YiFei Zhu <yifeifz2@xxxxxxxxxxxx> > Signed-off-by: YiFei Zhu <yifeifz2@xxxxxxxxxxxx> > --- > arch/x86/include/asm/seccomp.h | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > > diff --git a/arch/x86/include/asm/seccomp.h b/arch/x86/include/asm/seccomp.h > index 2bd1338de236..03365af6165d 100644 > --- a/arch/x86/include/asm/seccomp.h > +++ b/arch/x86/include/asm/seccomp.h > @@ -16,6 +16,18 @@ > #define __NR_seccomp_sigreturn_32 __NR_ia32_sigreturn > #endif > > +#ifdef CONFIG_X86_64 > +# define SECCOMP_ARCH_NATIVE AUDIT_ARCH_X86_64 > +# define SECCOMP_ARCH_NATIVE_NR NR_syscalls > +# ifdef CONFIG_COMPAT > +# define SECCOMP_ARCH_COMPAT AUDIT_ARCH_I386 > +# define SECCOMP_ARCH_COMPAT_NR IA32_NR_syscalls > +# endif > +#else /* !CONFIG_X86_64 */ > +# define SECCOMP_ARCH_NATIVE AUDIT_ARCH_I386 > +# define SECCOMP_ARCH_NATIVE_NR NR_syscalls > +#endif Is the idea that any syscall that's out of range for this (e.g. all of the x32 syscalls) is unoptimized? I'm okay with this, but I think it could use a comment. > + > #include <asm-generic/seccomp.h> > > #endif /* _ASM_X86_SECCOMP_H */ > -- > 2.28.0 > -- Andy Lutomirski AMA Capital Management, LLC
