72 lines
1.6 KiB
C
72 lines
1.6 KiB
C
#include <linux/version.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/nsproxy.h>
|
|
#include <linux/filter.h>
|
|
#include <linux/seccomp.h>
|
|
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0)
|
|
#include <linux/sched/task.h>
|
|
#else
|
|
#include <linux/sched.h>
|
|
#endif
|
|
#include <linux/uaccess.h>
|
|
#include "klog.h" // IWYU pragma: keep
|
|
#include "seccomp_cache.h"
|
|
|
|
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 2) // Android backport this feature in 5.10.2
|
|
struct action_cache {
|
|
DECLARE_BITMAP(allow_native, NR_syscalls);
|
|
#ifdef SECCOMP_ARCH_COMPAT
|
|
DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR);
|
|
#endif
|
|
};
|
|
|
|
struct seccomp_filter {
|
|
refcount_t refs;
|
|
refcount_t users;
|
|
bool log;
|
|
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)
|
|
bool wait_killable_recv;
|
|
#endif
|
|
struct action_cache cache;
|
|
struct seccomp_filter *prev;
|
|
struct bpf_prog *prog;
|
|
struct notification *notif;
|
|
struct mutex notify_lock;
|
|
wait_queue_head_t wqh;
|
|
};
|
|
|
|
void ksu_seccomp_clear_cache(struct seccomp_filter *filter, int nr)
|
|
{
|
|
if (!filter) {
|
|
return;
|
|
}
|
|
|
|
if (nr >= 0 && nr < NR_syscalls) {
|
|
clear_bit(nr, filter->cache.allow_native);
|
|
}
|
|
|
|
#ifdef SECCOMP_ARCH_COMPAT
|
|
if (nr >= 0 && nr < SECCOMP_ARCH_COMPAT_NR) {
|
|
clear_bit(nr, filter->cache.allow_compat);
|
|
}
|
|
#endif
|
|
}
|
|
|
|
void ksu_seccomp_allow_cache(struct seccomp_filter *filter, int nr)
|
|
{
|
|
if (!filter) {
|
|
return;
|
|
}
|
|
|
|
if (nr >= 0 && nr < NR_syscalls) {
|
|
set_bit(nr, filter->cache.allow_native);
|
|
}
|
|
|
|
#ifdef SECCOMP_ARCH_COMPAT
|
|
if (nr >= 0 && nr < SECCOMP_ARCH_COMPAT_NR) {
|
|
set_bit(nr, filter->cache.allow_compat);
|
|
}
|
|
#endif
|
|
}
|
|
#endif
|