[PATCH] seccomp: not compatible with ARM OABI

[PATCH] seccomp: not compatible with ARM OABI

[Kees Cook]

Make sure that seccomp filter won't be built when ARM OABI is in use,
since there is work needed to distinguish calling conventions. Until
that is done (which is likely never since OABI is deprecated), make
sure seccomp filter is unavailable in the OABI compat world.

Signed-off-by: Kees Cook <keescook@chromium.org>
---
 arch/Kconfig |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/Kconfig b/arch/Kconfig
index af2cc6eabcc7..6eaca7d92399 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -331,12 +331,15 @@ config HAVE_ARCH_SECCOMP_FILTER
 
 config SECCOMP_FILTER
 	def_bool y
-	depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET
+	depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET && !OABI_COMPAT
 	help
 	  Enable tasks to build secure computing environments defined
 	  in terms of Berkeley Packet Filter programs which implement
 	  task-defined system call filtering polices.
 
+	  Not available on ARM when built with OABI compatibility due to
+	  lack of a sensible way to distinguish the calling conventions.
+
 	  See Documentation/prctl/seccomp_filter.txt for details.
 
 config HAVE_CONTEXT_TRACKING
-- 
1.7.9.5


-- 
Kees Cook
Chrome OS Security

Re: [PATCH] seccomp: not compatible with ARM OABI

[Will Drewry]

Thanks!

Reviewed-By: Will Drewry <wad@chromium.org>

On Wed, Nov 6, 2013 at 5:31 PM, Kees Cook <keescook@chromium.org> wrote:
> Make sure that seccomp filter won't be built when ARM OABI is in use,
> since there is work needed to distinguish calling conventions. Until
> that is done (which is likely never since OABI is deprecated), make
> sure seccomp filter is unavailable in the OABI compat world.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
>  arch/Kconfig |    5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/arch/Kconfig b/arch/Kconfig
> index af2cc6eabcc7..6eaca7d92399 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -331,12 +331,15 @@ config HAVE_ARCH_SECCOMP_FILTER
>
>  config SECCOMP_FILTER
>         def_bool y
> -       depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET
> +       depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET && !OABI_COMPAT
>         help
>           Enable tasks to build secure computing environments defined
>           in terms of Berkeley Packet Filter programs which implement
>           task-defined system call filtering polices.
>
> +         Not available on ARM when built with OABI compatibility due to
> +         lack of a sensible way to distinguish the calling conventions.
> +
>           See Documentation/prctl/seccomp_filter.txt for details.
>
>  config HAVE_CONTEXT_TRACKING
> --
> 1.7.9.5
>
>
> --
> Kees Cook
> Chrome OS Security

Re: [PATCH] seccomp: not compatible with ARM OABI

[James Hogan]

Hi,

On 06/11/13 23:31, Kees Cook wrote:
> diff --git a/arch/Kconfig b/arch/Kconfig
> index af2cc6eabcc7..6eaca7d92399 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -331,12 +331,15 @@ config HAVE_ARCH_SECCOMP_FILTER
>  
>  config SECCOMP_FILTER
>  	def_bool y
> -	depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET
> +	depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET && !OABI_COMPAT

Isn't this the whole point of HAVE_ARCH_SECCOMP_FILTER?

Just change the select in arch/arm/Kconfig to this:

	select HAVE_ARCH_SECCOMP_FILTER if !OABI_COMPAT

Cheers
James

Re: [PATCH] seccomp: not compatible with ARM OABI

[Kees Cook]

On Thu, Nov 7, 2013 at 2:59 AM, James Hogan <james.hogan@imgtec.com> wrote:
> Hi,
>
> On 06/11/13 23:31, Kees Cook wrote:
>> diff --git a/arch/Kconfig b/arch/Kconfig
>> index af2cc6eabcc7..6eaca7d92399 100644
>> --- a/arch/Kconfig
>> +++ b/arch/Kconfig
>> @@ -331,12 +331,15 @@ config HAVE_ARCH_SECCOMP_FILTER
>>
>>  config SECCOMP_FILTER
>>       def_bool y
>> -     depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET
>> +     depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET && !OABI_COMPAT
>
> Isn't this the whole point of HAVE_ARCH_SECCOMP_FILTER?
>
> Just change the select in arch/arm/Kconfig to this:
>
>         select HAVE_ARCH_SECCOMP_FILTER if !OABI_COMPAT

Oh! Yeah, that's a much cleaner way to handle it. I totally forgot
that "select" could be conditional. I will respin it that way.

Thanks!

-Kees

-- 
Kees Cook
Chrome OS Security