[Trusty][pull-request] LP: #1379020 (seccomp tsync)

[Kees Cook]

Hi!

This is to backport the seccomp thread-sync (and syscall) interface from
3.17. There was some backporting needed in a few areas, as marked in
[]s before my SoB in the series. The most notable is skipping various
new syscalls (which are wired to sys_ni_syscall).

This has been tested against the seccomp regression test suite on
x86_64. I don't have a working Ubuntu ARM test environment, so that
is presently untested. The series is, however, based on the Chrome OS
backport to 3.14, which builds and works on ARM. In theory it should be
fine on Ubuntu too! :)

Thanks!

-Kees

The following changes since commit 5a08fea5398ad558f2b2ee884ff93ddf6c34108a:

  UBUNTU: Ubuntu-3.13.0-37.64 (2014-09-22 15:51:48 -0400)

are available in the git repository at:

  git at github.com:kees/linux.git ubuntu-trusty

for you to fetch changes up to 0e61aac09d3c46fcddd3ee4dfa625d5e541ecea4:

  seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock (2014-10-08 13:57:11 -0700)

----------------------------------------------------------------
Guenter Roeck (1):
      seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock

Kees Cook (11):
      seccomp: create internal mode-setting function
      seccomp: extract check/assign mode helpers
      seccomp: split mode setting routines
      seccomp: add "seccomp" syscall
      ARM: add seccomp syscall
      MIPS: add seccomp syscall
      sched: move no_new_privs into new atomic flags
      seccomp: split filter prep from check and apply
      seccomp: introduce writer locking
      seccomp: allow mode setting across threads
      seccomp: implement SECCOMP_FILTER_FLAG_TSYNC

Rashika Kheria (1):
      UPSTREAM: kernel: Mark function as static in kernel/seccomp.c

Will Deacon (1):
      ARM: 8087/1: ptrace: reload syscall number after secure_computing() check

 arch/Kconfig                        |   1 +
 arch/arm/include/uapi/asm/unistd.h  |   4 +
 arch/arm/kernel/calls.S             |   4 +
 arch/arm/kernel/ptrace.c            |   7 +-
 arch/mips/include/uapi/asm/unistd.h |  24 +++-
 arch/mips/kernel/scall32-o32.S      |   4 +
 arch/mips/kernel/scall64-64.S       |   4 +
 arch/mips/kernel/scall64-n32.S      |   4 +
 arch/mips/kernel/scall64-o32.S      |   4 +
 arch/x86/syscalls/syscall_32.tbl    |   4 +
 arch/x86/syscalls/syscall_64.tbl    |   4 +
 fs/exec.c                           |   6 +-
 include/linux/sched.h               |  18 ++-
 include/linux/seccomp.h             |   8 +-
 include/linux/syscalls.h            |   2 +
 include/uapi/asm-generic/unistd.h   |  10 +-
 include/uapi/linux/seccomp.h        |   7 +
 kernel/fork.c                       |  49 ++++++-
 kernel/seccomp.c                    | 412 ++++++++++++++++++++++++++++++++++++++++++++++++--------
 kernel/sys.c                        |   4 +-
 kernel/sys_ni.c                     |   3 +
 security/apparmor/domain.c          |   4 +-
 22 files changed, 505 insertions(+), 82 deletions(-)


-- 
Kees Cook