Re: [PATCH v5 2/2] m68k: add kernel seccomp support

[Michael Schmitz <schmitzmic@gmail.com>]

Hi Geert,

I haven't been able to compile that one using the cross compiler:

m68k-linux-gnu-gcc -Wl,-no-as-needed -Wall  -lpthread seccomp_bpf.c  -o 
/usr/misc/m68k/linux-m68k-git/linux-m68k/tools/testing/selftests/seccomp/seccomp_bpf
seccomp_bpf.c: In function ‘user_notification_addfd’:
seccomp_bpf.c:3968:10: warning: implicit declaration of function 
‘memfd_create’ [-Wimplicit-function-declaration]
   memfd = memfd_create("test", 0);
           ^
/tmp/ccfLGgXj.o: In function `user_notification_addfd':
seccomp_bpf.c:(.text+0x2ab32): undefined reference to `memfd_create'
/tmp/ccfLGgXj.o: In function `user_notification_addfd_rlimit':
seccomp_bpf.c:(.text+0x2c8a2): undefined reference to `memfd_create'
collect2: error: ld returned 1 exit status
../lib.mk:144: recipe for target 
'/usr/misc/m68k/linux-m68k-git/linux-m68k/tools/testing/selftests/seccomp/seccomp_bpf' 
failed

Adding the memfd_create definition found in 
tools/testing/selftests/drivers/dma-buf/udmabuf.c:

diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c 
b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 66f5145..231d772 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -266,6 +266,11 @@ struct seccomp_notif_addfd_big {
  #define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4)
  #endif

+static int memfd_create(const char *name, unsigned int flags)
+{
+       return syscall(__NR_memfd_create, name, flags);
+}
+
  #ifndef seccomp
  int seccomp(unsigned int op, unsigned int flags, void *args)
  {

allows the tests to compile.

Running the test cases requires a fairly recent system - seccomp_bpf had 
35 tests pass, 52 fail.

Cheers,

     Michael




On 23/06/21 7:35 pm, Geert Uytterhoeven wrote:
> Hi Michael,
>
> On Thu, Jun 17, 2021 at 7:39 AM Michael Schmitz <schmitzmic@gmail.com> wrote:
>> Add secure_computing() call to syscall_trace_enter to actually
>> filter system calls.
>>
>> Add necessary arch Kconfig options, define TIF_SECCOMP trace
>> flag and provide basic seccomp filter support in asm/syscall.h
>>
>> syscall_get_nr currently uses the syscall nr stored in orig_d0
>> because we change d0 to a default return code before starting a
>> syscall trace. This may be inconsistent with syscall_rollback
>> copying orig_d0 to d0 (which we never check upon return from
>> trace). We use d0 for the return code from syscall_trace_enter
>> in entry.S currently, and could perhaps expand that to store
>> a new syscall number returned by the seccomp filter before
>> executing the syscall. This clearly needs some discussion.
>>
>> Compiles (for Atari) and boots on ARAnyM, otherwise untested.
>>
>> Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
>> ---
>>   arch/m68k/Kconfig                   |  2 ++
>>   arch/m68k/include/asm/seccomp.h     | 11 +++++++++++
>>   arch/m68k/include/asm/syscall.h     | 33 +++++++++++++++++++++++++++++++++
>>   arch/m68k/include/asm/thread_info.h |  2 ++
>>   arch/m68k/kernel/ptrace.c           |  5 +++++
>>   5 files changed, 53 insertions(+)
>>   create mode 100644 arch/m68k/include/asm/seccomp.h
>>
>> diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
>> index 372e4e6..deaea88 100644
>> --- a/arch/m68k/Kconfig
>> +++ b/arch/m68k/Kconfig
>> @@ -19,6 +19,8 @@ config M68K
>>          select GENERIC_STRNCPY_FROM_USER if MMU
>>          select GENERIC_STRNLEN_USER if MMU
>>          select HAVE_AOUT if MMU
>> +       select HAVE_ARCH_SECCOMP
>> +       select HAVE_ARCH_SECCOMP_FILTER
> So the status should be changed from "TODO" to "ok" in
> Documentation/features/seccomp/seccomp-filter/arch-support.txt
>
> BTW, there was also "[PATCH] [WIP] selftests/seccomp: Add m68k support"
> https://lore.kernel.org/linux-m68k/alpine.DEB.2.21.2008261315050.25325@ramsan.of.borg/
>
> I kept on up-porting it, but haven't exercised it recently.
> Recent version looks like (gmail-whitespace-damaged):
>
> --- a/tools/testing/selftests/seccomp/seccomp_bpf.c
> +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
> @@ -135,6 +135,8 @@ struct seccomp_data {
>   #  define __NR_seccomp 337
>   # elif defined(__sh__)
>   #  define __NR_seccomp 372
> +# elif defined(__mc68000__)
> +#  define __NR_seccomp 380
>   # else
>   #  warning "seccomp syscall number unknown for this architecture"
>   #  define __NR_seccomp 0xffff
> @@ -1815,6 +1817,10 @@ TEST_F(TRACE_poke, getpid_runs_normally)
>   # define ARCH_REGS             struct pt_regs
>   # define SYSCALL_NUM(_regs)    (_regs).regs[3]
>   # define SYSCALL_RET(_regs)    (_regs).regs[0]
> +#elif defined(__mc68000__)
> +# define ARCH_REGS             struct pt_regs
> +# define SYSCALL_NUM(_regs)    (_regs).orig_d0
> +# define SYSCALL_RET(_regs)    (_regs).d0
>   #else
>   # error "Do not know how to find your architecture's registers and syscalls"
>   #endif
> @@ -1879,7 +1885,7 @@ const bool ptrace_entry_set_syscall_ret =
>    * Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
>    * architectures without HAVE_ARCH_TRACEHOOK (e.g. User-mode Linux).
>    */
> -#if defined(__x86_64__) || defined(__i386__) || defined(__mips__)
> +#if defined(__x86_64__) || defined(__i386__) || defined(__mips__) ||
> defined(__mc68000)
>   # define ARCH_GETREGS(_regs)   ptrace(PTRACE_GETREGS, tracee, 0, &(_regs))
>   # define ARCH_SETREGS(_regs)   ptrace(PTRACE_SETREGS, tracee, 0, &(_regs))
>   #else
>
> Gr{oetje,eeting}s,
>
>                          Geert
>