seccomp.c 1.1 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556
  1. /*
  2. * linux/kernel/seccomp.c
  3. *
  4. * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
  5. *
  6. * This defines a simple but solid secure-computing mode.
  7. */
  8. #include <linux/seccomp.h>
  9. #include <linux/sched.h>
  10. /* #define SECCOMP_DEBUG 1 */
  11. /*
  12. * Secure computing mode 1 allows only read/write/exit/sigreturn.
  13. * To be fully secure this must be combined with rlimit
  14. * to limit the stack allocations too.
  15. */
  16. static int mode1_syscalls[] = {
  17. __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
  18. 0, /* null terminated */
  19. };
  20. #ifdef TIF_32BIT
  21. static int mode1_syscalls_32[] = {
  22. __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32,
  23. 0, /* null terminated */
  24. };
  25. #endif
  26. void __secure_computing(int this_syscall)
  27. {
  28. int mode = current->seccomp.mode;
  29. int * syscall;
  30. switch (mode) {
  31. case 1:
  32. syscall = mode1_syscalls;
  33. #ifdef TIF_32BIT
  34. if (test_thread_flag(TIF_32BIT))
  35. syscall = mode1_syscalls_32;
  36. #endif
  37. do {
  38. if (*syscall == this_syscall)
  39. return;
  40. } while (*++syscall);
  41. break;
  42. default:
  43. BUG();
  44. }
  45. #ifdef SECCOMP_DEBUG
  46. dump_stack();
  47. #endif
  48. do_exit(SIGKILL);
  49. }