Home
last modified time | relevance | path

Searched refs:seccomp (Results 1 – 25 of 64) sorted by relevance

123

/linux-6.3-rc2/Documentation/translations/zh_CN/userspace-api/
A Dseccomp_filter.rst29 此外，BPF让seccomp用户不再成为在系统调用干预框架（system call interposition
45 添加了一个额外的seccomp模式，它可以使用和严格seccomp相同的 prctl(2) 调用来启用。
76 一个seccomp过滤器可能返回下列任意值。如果多个过滤器存在，评估一个指定系统调用的
121 在追踪器被通知后，seccomp检查不会再次运行。（这意味着基于seccomp的沙箱必须禁止
171 seccomp通知文件描述符由两个结构体组成：
201 seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes);
208 间对于监听者的pid命名空间不可见的话，可能为0）。通知还包含传递给seccomp的 ``data``
244 这个列表代表了内核支持的seccomp返回值集合。一个用户空间程序可以使用这个列表来在
245 程序建立时确定在 ``seccomp.h`` 中找到的动作是否和当前运行内核实际支持的动作有所
259 seccomp，那么它将可以通过较小的修改支持seccomp过滤器： ``SIGSYS`` 支持和seccomp
[all …]
A Dno_new_privs.rst46 - 为seccomp模式2沙箱安装的过滤器会跨execve持久化，并能够改变新执行程序的行为。
/linux-6.3-rc2/include/linux/
A Dseccomp.h37 struct seccomp { struct
58 static inline int seccomp_mode(struct seccomp *s) in seccomp_mode() argument
67 struct seccomp { }; struct
88 static inline int seccomp_mode(struct seccomp *s) in seccomp_mode()
/linux-6.3-rc2/kernel/
A Dseccomp.c407 READ_ONCE(current->seccomp.filter); in seccomp_run_filters()
436 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode) in seccomp_may_assign_mode()
450 task->seccomp.mode = seccomp_mode; in seccomp_assign_mode()
504 caller->seccomp.filter))) in seccomp_can_sync_threads()
570 tsk->seccomp.filter = NULL; in seccomp_filter_release()
608 caller->seccomp.filter); in seccomp_sync_threads()
909 current->seccomp.filter = filter; in seccomp_attach_filter()
1030 int mode = current->seccomp.mode; in secure_computing_strict()
1327 int mode = current->seccomp.mode; in __secure_computing()
1356 return current->seccomp.mode; in prctl_get_seccomp()
[all …]
A Dptrace.c381 if (seccomp_mode(&current->seccomp) != SECCOMP_MODE_DISABLED || in check_ptrace_options()
966 info->seccomp.ret_data = child->ptrace_message; in ptrace_get_syscall_info_seccomp()
969 return offsetofend(struct ptrace_syscall_info, seccomp.ret_data); in ptrace_get_syscall_info_seccomp()
A DMakefile95 obj-$(CONFIG_SECCOMP) += seccomp.o
A Dsys_ni.c336 COND_SYSCALL(seccomp);
/linux-6.3-rc2/Documentation/userspace-api/
A Dseccomp_filter.rst46 An additional seccomp mode is added and is enabled using the same
47 prctl(2) call as the strict seccomp. If the architecture has
149 The seccomp check will not be run again after the tracer is
150 notified. (This means that seccomp-based sandboxes MUST NOT
200 argument to the ``seccomp()`` syscall:
244 seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes);
247 samples/seccomp/user-trap.c for an example.
304 The list represents the set of seccomp return values supported
306 determine if the actions found in the ``seccomp.h``, when the
326 support seccomp filter with minor fixup: ``SIGSYS`` support and seccomp return
[all …]
A Dno_new_privs.rst47 - Filters installed for the seccomp mode 2 sandbox persist across
/linux-6.3-rc2/Documentation/features/seccomp/seccomp-filter/
A Darch-support.txt2 # Feature name: seccomp-filter
4 # description: arch supports seccomp filters
/linux-6.3-rc2/tools/testing/selftests/seccomp/
A Dseccomp_bpf.c282 #ifndef seccomp
835 ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, in kill_thread_or_group()
2123 FIXTURE_VARIANT_ADD(TRACE_syscall, seccomp) { in FIXTURE_VARIANT_ADD() argument
2319 ret = seccomp(-1, 0, &prog); in TEST()
2328 ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL); in TEST()
2332 ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog); in TEST()
2342 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL); in TEST()
2347 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog); in TEST()
2370 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog); in TEST()
2384 ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL); in TEST()
[all …]
/linux-6.3-rc2/samples/seccomp/
A Duser-trap.c26 static int seccomp(unsigned int op, unsigned int flags, void *args) in seccomp() function
101 return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog); in user_trap_syscall()
293 if (seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes) < 0) { in main()
/linux-6.3-rc2/rust/
A Dbindgen_parameters21 # `seccomp`'s comment gets understood as a doctest
/linux-6.3-rc2/samples/
A DMakefile20 subdir-$(CONFIG_SAMPLE_SECCOMP) += seccomp
A DKconfig177 bool "Build seccomp sample code"
180 Build samples of seccomp filters using various methods of
/linux-6.3-rc2/include/uapi/linux/
A Dptrace.h101 } seccomp; member
/linux-6.3-rc2/arch/mips/kernel/
A Dscall64-n32.S78 bltz v0, 1f # seccomp failed? Skip syscall
A Dscall64-n64.S88 bltz v0, 1f # seccomp failed? Skip syscall
A Dscall32-o32.S128 bltz v0, 1f # seccomp failed? Skip syscall
A Dscall64-o32.S133 bltz v0, 1f # seccomp failed? Skip syscall
/linux-6.3-rc2/arch/loongarch/
A DKconfig525 bool "Enable seccomp to safely compute untrusted bytecode"
534 their own address space using seccomp. Once seccomp is
535 enabled via /proc/<pid>/seccomp, it cannot be disabled
537 defined by each seccomp mode.
/linux-6.3-rc2/arch/
A DKconfig504 An arch should select this symbol to support seccomp mode 1 (the fixed
506 and compat syscalls if the asm-generic/seccomp.h defaults need adjustment:
526 - seccomp syscall wired up
532 prompt "Enable seccomp to safely execute untrusted bytecode"
541 own address space using seccomp. Once seccomp is enabled via
542 prctl(PR_SET_SECCOMP) or the seccomp() syscall, it cannot be
544 syscalls defined by each seccomp mode.
559 bool "Show seccomp filter cache status in /proc/pid/seccomp_cache"
564 seccomp cache data. The file format is subject to change. Reading
568 an adversary may be able to infer the seccomp filter logic.
/linux-6.3-rc2/init/
A Dinit_task.c211 .seccomp = { .filter_count = ATOMIC_INIT(0) },
/linux-6.3-rc2/tools/testing/selftests/
A DMakefile69 TARGETS += seccomp
/linux-6.3-rc2/fs/proc/
A Darray.c334 seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode); in task_seccomp()
337 atomic_read(&p->seccomp.filter_count)); in task_seccomp()

Completed in 39 milliseconds

123