Please see prior revisions for a detailed discussion of this patch series. This series is a rebase on to: b5174fa3a7f4f8f150bfa3b917c92608953dfa0f with very minor changes due to rebasing and tweaks noticed by a few initial users. (I will rebase again for v3.4-rc1 when that time comes.) I realize now is a noisy time, but I wanted to get the most current revision on the list. As per prior posts, I am now including luto@'s PR_SET_NO_NEW_PRIVS changes in the series for clarity and ease of testing. This latest rebased required required bumping the prctl() numbers for the NO_NEW_PRIVS work due to the new reaper options. For those inclined, the whole series can be found here too: https://github.com/redpig/linux/tree/seccomp At this point, I'm not aware of any outstanding concerns, complaints, etc. If there are any, I'd love to know. Thanks! will Andy Lutomirski (1): Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs John Johansen (1): Fix apparmor for PR_{GET,SET}_NO_NEW_PRIVS Kees Cook (1): seccomp: remove duplicated failure logging Will Drewry (12): sk_run_filter: add BPF_S_ANC_SECCOMP_LD_W net/compat.c,linux/filter.h: share compat_sock_fprog seccomp: kill the seccomp_t typedef arch/x86: add syscall_get_arch to syscall.h asm/syscall.h: add syscall_get_arch seccomp: add system call filtering using BPF seccomp: add SECCOMP_RET_ERRNO signal, x86: add SIGSYS info and make it synchronous. seccomp: Add SECCOMP_RET_TRAP ptrace,seccomp: Add PTRACE_SECCOMP support x86: Enable HAVE_ARCH_SECCOMP_FILTER Documentation: prctl/seccomp_filter Documentation/prctl/seccomp_filter.txt | 163 ++++++++++++ arch/Kconfig | 24 ++ arch/x86/Kconfig | 1 + arch/x86/ia32/ia32_signal.c | 4 + arch/x86/include/asm/ia32.h | 6 + arch/x86/include/asm/syscall.h | 23 ++ arch/x86/kernel/ptrace.c | 7 +- fs/exec.c | 10 +- include/asm-generic/siginfo.h | 22 ++ include/asm-generic/syscall.h | 14 + include/linux/Kbuild | 1 + include/linux/audit.h | 8 +- include/linux/filter.h | 12 + include/linux/prctl.h | 15 + include/linux/ptrace.h | 5 +- include/linux/sched.h | 4 +- include/linux/seccomp.h | 105 +++++++- include/linux/security.h | 1 + kernel/auditsc.c | 10 +- kernel/fork.c | 3 + kernel/seccomp.c | 447 ++++++++++++++++++++++++++++++-- kernel/signal.c | 9 +- kernel/sys.c | 12 +- net/compat.c | 8 - net/core/filter.c | 6 + samples/Makefile | 2 +- samples/seccomp/Makefile | 38 +++ samples/seccomp/bpf-direct.c | 176 +++++++++++++ samples/seccomp/bpf-fancy.c | 102 ++++++++ samples/seccomp/bpf-helper.c | 89 +++++++ samples/seccomp/bpf-helper.h | 238 +++++++++++++++++ samples/seccomp/dropper.c | 68 +++++ security/apparmor/domain.c | 35 +++ security/commoncap.c | 7 +- security/selinux/hooks.c | 10 +- 35 files changed, 1628 insertions(+), 57 deletions(-) create mode 100644 Documentation/prctl/seccomp_filter.txt create mode 100644 samples/seccomp/Makefile create mode 100644 samples/seccomp/bpf-direct.c create mode 100644 samples/seccomp/bpf-fancy.c create mode 100644 samples/seccomp/bpf-helper.c create mode 100644 samples/seccomp/bpf-helper.h create mode 100644 samples/seccomp/dropper.c -- 1.7.5.4 -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
