| 12345678910111213141516171819202122232425262728293031323334 |
- --- a/kernel/seccomp.c
- +++ b/kernel/seccomp.c
- @@ -614,6 +614,7 @@ int __secure_computing(void)
- #ifdef CONFIG_SECCOMP_FILTER
- static u32 __seccomp_phase1_filter(int this_syscall, struct seccomp_data *sd)
- {
- + char name[sizeof(current->comm)];
- u32 filter_ret, action;
- int data;
-
- @@ -644,6 +645,13 @@ static u32 __seccomp_phase1_filter(int t
- case SECCOMP_RET_TRACE:
- return filter_ret; /* Save the rest for phase 2. */
-
- + case SECCOMP_RET_LOG:
- + get_task_comm(name, current);
- + pr_err_ratelimited("seccomp: %s [%u] tried to call non-whitelisted syscall: %d\n", name, current->pid, this_syscall);
- + syscall_set_return_value(current, task_pt_regs(current),
- + -data, 0);
- + goto skip;
- +
- case SECCOMP_RET_ALLOW:
- return SECCOMP_PHASE1_OK;
-
- --- a/include/uapi/linux/seccomp.h
- +++ b/include/uapi/linux/seccomp.h
- @@ -28,6 +28,7 @@
- #define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */
- #define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */
- #define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */
- +#define SECCOMP_RET_LOG 0x00070000U /* allow + logline */
- #define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */
- #define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
-
|
