diff options
author | Will Drewry <wad@chromium.org> | 2012-03-09 10:43:50 -0600 |
---|---|---|
committer | John Rigby <john.rigby@linaro.org> | 2012-06-23 23:13:59 -0600 |
commit | eb0aff467b92ece888dc8c352c4db250a2197fc2 (patch) | |
tree | 64b76f8245686effb815a00965420c57b8896871 | |
parent | 2048efb66793e75a9adb984ac7c6a030f1029919 (diff) |
UBUNTU: SAUCE: SECCOMP: sk_run_filter: add BPF_S_ANC_SECCOMP_LD_W
Introduces a new BPF ancillary instruction that all LD calls will be
mapped through when skb_run_filter() is being used for seccomp BPF. The
rewriting will be done using a secondary chk_filter function that is run
after skb_chk_filter.
The code change is guarded by CONFIG_SECCOMP_FILTER which is added,
along with the seccomp_bpf_load() function later in this series.
This is based on http://lkml.org/lkml/2012/3/2/141
v15: include seccomp.h explicitly for when seccomp_bpf_load exists.
v14: First cut using a single additional instruction
... v13: made bpf functions generic.
Suggested-by: Indan Zupancic <indan@nul.nu>
Signed-off-by: Will Drewry <wad@chromium.org>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Kees Cook <kees@ubuntu.com>
-rw-r--r-- | include/linux/filter.h | 1 | ||||
-rw-r--r-- | net/core/filter.c | 6 |
2 files changed, 7 insertions, 0 deletions
diff --git a/include/linux/filter.h b/include/linux/filter.h index 8eeb205f298..aaa2e80630b 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -228,6 +228,7 @@ enum { BPF_S_ANC_HATYPE, BPF_S_ANC_RXHASH, BPF_S_ANC_CPU, + BPF_S_ANC_SECCOMP_LD_W, }; #endif /* __KERNEL__ */ diff --git a/net/core/filter.c b/net/core/filter.c index 6f755cca452..491e2e1ec27 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -38,6 +38,7 @@ #include <linux/filter.h> #include <linux/reciprocal_div.h> #include <linux/ratelimit.h> +#include <linux/seccomp.h> /* No hurry in this branch * @@ -352,6 +353,11 @@ load_b: A = 0; continue; } +#ifdef CONFIG_SECCOMP_FILTER + case BPF_S_ANC_SECCOMP_LD_W: + A = seccomp_bpf_load(fentry->k); + continue; +#endif default: WARN_RATELIMIT(1, "Unknown code:%u jt:%u tf:%u k:%u\n", fentry->code, fentry->jt, |