From: Michael Schmitz <schmitzmic@gmail.com>
To: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Linux/m68k <linux-m68k@vger.kernel.org>,
John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>,
Andreas Schwab <schwab@linux-m68k.org>
Subject: Re: [PATCH v5 2/2] m68k: add kernel seccomp support
Date: Thu, 24 Jun 2021 14:13:12 +1200 [thread overview]
Message-ID: <c968ef23-bad9-aaef-ed18-03195f720c09@gmail.com> (raw)
In-Reply-To: <CAMuHMdX-JBTAWDvFQg7nVGwwxu8o6sX1GYVF0ha6JpZxOxuG8g@mail.gmail.com>
Hi Geert,
I haven't been able to compile that one using the cross compiler:
m68k-linux-gnu-gcc -Wl,-no-as-needed -Wall -lpthread seccomp_bpf.c -o
/usr/misc/m68k/linux-m68k-git/linux-m68k/tools/testing/selftests/seccomp/seccomp_bpf
seccomp_bpf.c: In function ‘user_notification_addfd’:
seccomp_bpf.c:3968:10: warning: implicit declaration of function
‘memfd_create’ [-Wimplicit-function-declaration]
memfd = memfd_create("test", 0);
^
/tmp/ccfLGgXj.o: In function `user_notification_addfd':
seccomp_bpf.c:(.text+0x2ab32): undefined reference to `memfd_create'
/tmp/ccfLGgXj.o: In function `user_notification_addfd_rlimit':
seccomp_bpf.c:(.text+0x2c8a2): undefined reference to `memfd_create'
collect2: error: ld returned 1 exit status
../lib.mk:144: recipe for target
'/usr/misc/m68k/linux-m68k-git/linux-m68k/tools/testing/selftests/seccomp/seccomp_bpf'
failed
Adding the memfd_create definition found in
tools/testing/selftests/drivers/dma-buf/udmabuf.c:
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c
b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 66f5145..231d772 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -266,6 +266,11 @@ struct seccomp_notif_addfd_big {
#define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4)
#endif
+static int memfd_create(const char *name, unsigned int flags)
+{
+ return syscall(__NR_memfd_create, name, flags);
+}
+
#ifndef seccomp
int seccomp(unsigned int op, unsigned int flags, void *args)
{
allows the tests to compile.
Running the test cases requires a fairly recent system - seccomp_bpf had
35 tests pass, 52 fail.
Cheers,
Michael
On 23/06/21 7:35 pm, Geert Uytterhoeven wrote:
> Hi Michael,
>
> On Thu, Jun 17, 2021 at 7:39 AM Michael Schmitz <schmitzmic@gmail.com> wrote:
>> Add secure_computing() call to syscall_trace_enter to actually
>> filter system calls.
>>
>> Add necessary arch Kconfig options, define TIF_SECCOMP trace
>> flag and provide basic seccomp filter support in asm/syscall.h
>>
>> syscall_get_nr currently uses the syscall nr stored in orig_d0
>> because we change d0 to a default return code before starting a
>> syscall trace. This may be inconsistent with syscall_rollback
>> copying orig_d0 to d0 (which we never check upon return from
>> trace). We use d0 for the return code from syscall_trace_enter
>> in entry.S currently, and could perhaps expand that to store
>> a new syscall number returned by the seccomp filter before
>> executing the syscall. This clearly needs some discussion.
>>
>> Compiles (for Atari) and boots on ARAnyM, otherwise untested.
>>
>> Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
>> ---
>> arch/m68k/Kconfig | 2 ++
>> arch/m68k/include/asm/seccomp.h | 11 +++++++++++
>> arch/m68k/include/asm/syscall.h | 33 +++++++++++++++++++++++++++++++++
>> arch/m68k/include/asm/thread_info.h | 2 ++
>> arch/m68k/kernel/ptrace.c | 5 +++++
>> 5 files changed, 53 insertions(+)
>> create mode 100644 arch/m68k/include/asm/seccomp.h
>>
>> diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
>> index 372e4e6..deaea88 100644
>> --- a/arch/m68k/Kconfig
>> +++ b/arch/m68k/Kconfig
>> @@ -19,6 +19,8 @@ config M68K
>> select GENERIC_STRNCPY_FROM_USER if MMU
>> select GENERIC_STRNLEN_USER if MMU
>> select HAVE_AOUT if MMU
>> + select HAVE_ARCH_SECCOMP
>> + select HAVE_ARCH_SECCOMP_FILTER
> So the status should be changed from "TODO" to "ok" in
> Documentation/features/seccomp/seccomp-filter/arch-support.txt
>
> BTW, there was also "[PATCH] [WIP] selftests/seccomp: Add m68k support"
> https://lore.kernel.org/linux-m68k/alpine.DEB.2.21.2008261315050.25325@ramsan.of.borg/
>
> I kept on up-porting it, but haven't exercised it recently.
> Recent version looks like (gmail-whitespace-damaged):
>
> --- a/tools/testing/selftests/seccomp/seccomp_bpf.c
> +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
> @@ -135,6 +135,8 @@ struct seccomp_data {
> # define __NR_seccomp 337
> # elif defined(__sh__)
> # define __NR_seccomp 372
> +# elif defined(__mc68000__)
> +# define __NR_seccomp 380
> # else
> # warning "seccomp syscall number unknown for this architecture"
> # define __NR_seccomp 0xffff
> @@ -1815,6 +1817,10 @@ TEST_F(TRACE_poke, getpid_runs_normally)
> # define ARCH_REGS struct pt_regs
> # define SYSCALL_NUM(_regs) (_regs).regs[3]
> # define SYSCALL_RET(_regs) (_regs).regs[0]
> +#elif defined(__mc68000__)
> +# define ARCH_REGS struct pt_regs
> +# define SYSCALL_NUM(_regs) (_regs).orig_d0
> +# define SYSCALL_RET(_regs) (_regs).d0
> #else
> # error "Do not know how to find your architecture's registers and syscalls"
> #endif
> @@ -1879,7 +1885,7 @@ const bool ptrace_entry_set_syscall_ret =
> * Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
> * architectures without HAVE_ARCH_TRACEHOOK (e.g. User-mode Linux).
> */
> -#if defined(__x86_64__) || defined(__i386__) || defined(__mips__)
> +#if defined(__x86_64__) || defined(__i386__) || defined(__mips__) ||
> defined(__mc68000)
> # define ARCH_GETREGS(_regs) ptrace(PTRACE_GETREGS, tracee, 0, &(_regs))
> # define ARCH_SETREGS(_regs) ptrace(PTRACE_SETREGS, tracee, 0, &(_regs))
> #else
>
> Gr{oetje,eeting}s,
>
> Geert
>
next prev parent reply other threads:[~2021-06-24 2:13 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-17 5:39 [PATCH v5 1/2] m68k/kernel - wire up syscall_trace_enter/leave for m68k Michael Schmitz
2021-06-17 5:39 ` [PATCH v5 2/2] m68k: add kernel seccomp support Michael Schmitz
2021-06-23 7:26 ` Geert Uytterhoeven
2021-06-23 8:33 ` Michael Schmitz
2021-06-23 23:31 ` Michael Schmitz
2021-06-23 7:35 ` Geert Uytterhoeven
2021-06-24 2:12 ` Michael Schmitz
2021-06-24 2:13 ` Michael Schmitz [this message]
2021-06-24 21:20 ` Michael Schmitz
2021-06-25 7:31 ` Geert Uytterhoeven
2021-06-25 18:42 ` Michael Schmitz
2021-06-25 21:15 ` Michael Schmitz
2021-06-28 7:18 ` Geert Uytterhoeven
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c968ef23-bad9-aaef-ed18-03195f720c09@gmail.com \
--to=schmitzmic@gmail.com \
--cc=geert@linux-m68k.org \
--cc=glaubitz@physik.fu-berlin.de \
--cc=linux-m68k@vger.kernel.org \
--cc=schwab@linux-m68k.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).