summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* arch: simplify the ppc/ppc64 code in arch-syscall-validatePaul Moore2020-03-231-12/+2
| | | | | | | We no longer need to do the complex substitutions we used to have to do for ppc/ppc64. Signed-off-by: Paul Moore <paul@paul-moore.com>
* travis: "sudo" no longer has any meaning in Travis CIPaul Moore2020-03-231-1/+0
| | | | | | | Travis CI identified some problems in our config, this patch fixes one of these problems. Signed-off-by: Paul Moore <paul@paul-moore.com>
* parisc64: separate parisc and parisc64Paul Moore2020-03-237-6/+40
| | | | | | | | Previously parisc64 was borrowing from parsic which led to problems with the syscall table for parisc64. This patch properly splits the two ABIs. Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: fix the library output of arch-syscall-validatePaul Moore2020-03-231-5/+4
| | | | | | | We no longer need to correct the syscall offsets for x32, mips, mips64, and mips64n32. Signed-off-by: Paul Moore <paul@paul-moore.com>
* travis: fix a typo with TRAVIS_CPU_ARCHPaul Moore2020-03-231-2/+2
| | | | | | | Travis CI uses "amd64" instead of "x86_64", fix the configuration. * https://docs.travis-ci.com/user/environment-variables Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: remove the unused, manually generated syscall tablesPaul Moore2020-03-2314-8121/+0
| | | | | | | | Since the move to gperf and the automatically generated syscall table in CSV format, these manually maintained tables are no longer needed. Reviewed-by: Tom Hromatka <tom.hromatka@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: use gperf to generate a perfact hash to lookup syscall namesGiuseppe Scrivano2020-03-2338-223/+1139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch significantly improves the performance of seccomp_syscall_resolve_name since it replaces the expensive strcmp for each syscall in the database, with a lookup table. The complexity for syscall_resolve_num is not changed and it uses the linear search, that is anyway less expensive than seccomp_syscall_resolve_name as it uses an index for comparison instead of doing a string comparison. On my machine, calling 1000 seccomp_syscall_resolve_name_arch and seccomp_syscall_resolve_num_arch over the entire syscalls DB passed from ~0.45 sec to ~0.06s. PM: After talking with Giuseppe I made a number of additional changes, some substantial, the highlights include: * various style tweaks * .gitignore fixes * fixed subject line, tweaked the description * dropped the arch-syscall-validate changes as they were masking other problems * extracted the syscalls.csv and file deletions to other patches to keep this one more focused * fixed the x86, x32, arm, all the MIPS ABIs, s390, and s390x ABIs as the syscall offsets were not properly incorporated into this change * cleaned up the ABI specific headers * cleaned up generate_syscalls_perf.sh and renamed to arch-gperf-generate * fixed problems with automake's file packaging Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Reviewed-by: Tom Hromatka <tom.hromatka@oracle.com> [PM: see notes in the "PM" section above] Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: add an automatically generated syscall table in CSV formatPaul Moore2020-03-232-1/+474
| | | | | | | | | | | | Later patches will make use of this new syscall table format instead of the manually maintained tables. The new CSV syscall table was generated with the following command: # ./arch-syscall-validate -c <kernel_source_dir> > syscalls.csv Reviewed-by: Tom Hromatka <tom.hromatka@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: add missing parisc64 support to arch-syscall-validatePaul Moore2020-03-221-0/+25
| | | | | | | | Commit c61950e1d972 ("arch: add missing parisc and parisc64 support to arch-syscall-validate") forgot to add parisc64 support, this patch fixes that. Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: add missing parisc and parisc64 support to arch-syscall-validatePaul Moore2020-03-211-5/+46
| | | | | | | For some reason we completely forgot to add this ABIs to the arch-syscall-validate script. Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: rework/fix the arch-syscall-validate scriptPaul Moore2020-03-201-107/+269
| | | | | | | | | | Update the arch-syscall-validate script to be "CSV friendly" in preparation for follow-up work to move the libseccomp internal syscall tables into a single CVS file. In this process of making this change, a number of unrelated problems with the script were identified and fixed. Signed-off-by: Paul Moore <paul@paul-moore.com>
* all: fix all the outstanding lgtm.com alertsPaul Moore2020-03-192-15/+15
| | | | | | | | | | There are no functional changes in this patch, just some minor changes found by the lgtm.com service: * four functions in tools/util.c were "hiding" a global variable with a local variable ("arch") * src/arch.c had an unnecessary check in an if-condition Signed-off-by: Paul Moore <paul@paul-moore.com>
* README: add the lgtm.com badgePaul Moore2020-03-191-0/+1
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* travis: enable aarch64 buildsPaul Moore2020-03-111-5/+15
| | | | | | | | | | | | | While we enable these additional architectures, we limit the code coverage test to x86_64 and the clang/scan-build check to platforms which support it. It is worth noting that the ppc64le and s390x builds were not enabled at this time due to Travis CI test failures that need to be investigated. Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: don't use the "tr" toolPaul Moore2020-03-111-1/+2
| | | | | | | | This appears to cause problems in the Travis CI with the aarch64 architecture. Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: fix some problems with test 53Paul Moore2020-03-101-6/+0
| | | | | | | | Two fixes to ensure that test 53 runs correctly: * remove a debug "print()" in the Python test * use the native ABI in the Python test Signed-off-by: Paul Moore <paul@paul-moore.com>
* build: fix building outside source directoryAndreas Schwab2020-03-102-3/+2
| | | | | | | | | Move -I${top_builddir}/include to toplevel so that it is available in all subdirs. This is needed to find <seccomp.h> in the build directory, since it is now a generated file. Signed-off-by: Andreas Schwab <schwab@suse.de> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: change test 55 to use syscall names rather than numbersTom Hromatka2020-03-102-1182/+233
| | | | | | | | | | | | Previously test 55, basic-pfc_binary_tree, used syscall numbers to build a large binary tree. This is problematic on architectures that have sparsely populated syscall numbers. This commit modifies the test to use syscall names to build up a realistic binary tree that should work on all architectures. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: change test 53 to use syscall names rather than numbersTom Hromatka2020-03-103-366/+176
| | | | | | | | | | | | Previously test 53, sim-binary_tree, used syscall numbers to build a large binary tree. This is problematic on architectures that have sparsely populated syscall numbers. This commit modifies the test to use syscall names to build up a realistic binary tree that should work on all architectures. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: Add riscv64 support to syscall validate scriptTom Hromatka2020-03-101-0/+45
| | | | | | | This patch adds riscv64 support to arch-syscall-validate. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: Add riscv64 support to arch-syscall-dumpTom Hromatka2020-03-101-0/+4
| | | | | | | This patch adds support for riscv64 to arch-syscall-dump.c Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* doc: update the CREDITS fileTom Hromatka2020-03-051-0/+3
| | | | | Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> (imported from commit 61108c050fd16ba13f0204f6ac3ca4cbeea86f58)
* doc: update the CHANGELOG for v2.4.3Tom Hromatka2020-03-051-0/+10
| | | | | Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> (imported from commit fcb1395979f784387984e34752c07a5e8530c023)
* tests: add tests for the binary treeTom Hromatka2020-02-2813-4/+2067
| | | | | | | | This commit adds tests to ensure the validity of the binary tree and the resultant pfc and bpf output. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* bpf:pfc: Add optimization option to use a binary treeTom Hromatka2020-02-287-44/+457
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a filter attribute, SCMP_FLTATR_CTL_OPTIMIZE, to specify the optimization level of the seccomp filter: 0 - currently unused 1 - rules weighted by priority and complexity (default) 2 - binary tree sorted by syscall number Several in-house customers have identified that their large seccomp filters are slowing down their applications. Their filters largely consist of simple allow/deny logic for many syscalls (306 in one case) and for the most part don't utilize argument filtering. I modified gen_bpf.c and gen_pfc.c to utilize a cBPF binary tree if the user has requested optimize level 2. I then timed calling getppid() in a loop using one of my customer's seccomp filters. I ran this loop one million times and recorded the min, max, and mean times (in TSC ticks) to call getppid(). (I didn't disable interrupts, so the max time was often large.) I chose to report the minimum time because I feel it best represents the actual time to traverse the syscall. Test Case minimum TSC ticks to make syscall ---------------------------------------------------------------- seccomp disabled 138 getppid() at the front of 306-syscall seccomp filter 256 getppid() in middle of 306-syscall seccomp filter 516 getppid() at the end of the 306-syscall filter 1942 getppid() in a binary tree 312 As shown in the table above, a binary tree can signficantly improve syscall performance in the average and worst case scenario for these customers. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* bpf: Refactor code that inserts instructions into BPF stateTom Hromatka2020-02-281-16/+36
| | | | | | | | | | This commit adds a function - _gen_bpf_insert() - that inserts an instruction block into the BPF state and creates the linked list connections for that newly-inserted block. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* bpf: Refactor syscall loop in _gen_bpf_arch()Tom Hromatka2020-02-281-66/+101
| | | | | | | | | | This commit splits out some init code and a lengthy for-loop in _gen_bpf_arch() into its own function - _gen_bpf_syscalls(). Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> [PM: fixed style problems found by check-syntax] Signed-off-by: Paul Moore <paul@paul-moore.com>
* bpf: Refactor duplicate sorting codeTom Hromatka2020-02-281-65/+48
| | | | | | | | | | In _gen_bpf_arch(), there was an identical block of code to sort the primary database syscalls and the secondary database syscalls. This commit refactors those duplicated, inline loops into a single function. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: Add RISC-V 64-bit supportAndreas Schwab2020-02-2322-2/+677
| | | | | | Signed-off-by: Andreas Schwab <schwab@suse.de> [PM: minor macro shuffling in seccomp.h.in] Signed-off-by: Paul Moore <paul@paul-moore.com>
* s390: Fix multiplexing issue with shm* syscallsTom Hromatka2020-02-222-0/+32
| | | | | | | | | | On s390, shmat, shmdt, shmget, and shmctl can be done either via sockets or ipc. Prior to this commit, the s390 code only supported these calls via sockets. This commit adds support for both sockets and ipc. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* doc: shuffle the CONTRIBUTING.md docPaul Moore2020-01-201-34/+32
| | | | | | | | Shuffle the sections around to make it more clear that the "Explain Your Work" and "Sign Your Work" sections apply to both email and GH workflows. Signed-off-by: Paul Moore <paul@paul-moore.com>
* travis: use default python instead of nightlyChristopher Waldon2020-01-201-2/+0
| | | | | | | | | | | Previously the live python tests failed in the TravisCI environment because the nightly python version changed in a subtle way that made the `cython` install unreliable. This change reverts to a stable version of python that is able to install cython reliably. Signed-off-by: Chris Waldon <chris.waldon@ibm.com> [PM: edits to the commit description] Signed-off-by: Paul Moore <paul@paul-moore.com>
* travis: avoid running live python tests in TravisCIChris Waldon2020-01-202-1/+5
| | | | | Signed-off-by: Chris Waldon <chris.waldon@ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* doc: update contribution guide to include github PR infoChris Waldon2020-01-161-2/+15
| | | | | | Signed-off-by: Chris Waldon <chris.waldon@ibm.com> Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* doc: ensure makefile installs seccomp_notify_* pagesChris Waldon2020-01-081-0/+6
| | | | | | Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Chris Waldon <chris.waldon@ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* doc: add a section on release tarball signatures to README.mdPaul Moore2020-01-061-0/+18
| | | | | Reviewed-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: rely on __SNR_xxx instead of __NR_xxx for syscallsPaul Moore2019-11-201-3/+3
| | | | | | | | We recently changed how libseccomp handles syscall numbers that are not defined natively, but we missed test #15. Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* build: try to use explicitly marked Python 3.x tools firstPaul Moore2019-11-191-6/+6
| | | | | | | | Python 2.x is going EOL very soon, so let's require Python 3.x now and attempt to use the explicitly marked Python 3.x tools first. Signed-off-by: Paul Moore <paul@paul-moore.com> Acked-by: Tom Hromatka <tom.hromatka@oracle.com>
* tools: remove static flag from the buildFabrice Fontaine2019-11-141-3/+0
| | | | | | | | | | | | | | Do not force static link of tools, it breaks build with: BR2_SHARED_LIBS=y Patch retrieved from https://git.buildroot.net/buildroot/tree/package/libseccomp/0001-remove-static.patch and slighly updated to work with 2.3.3 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Acked-by: Tom Hromatka <tom.hromatka@oracle.com> [PM: also removed the '-static' from the scmp_api_level build] Signed-off-by: Paul Moore <paul@paul-moore.com>
* travis: switch our Travis builds to Ubuntu 18.04 (Bionic Beaver)Paul Moore2019-11-131-2/+2
| | | | | | | | Oddly, going from 16.04 to 18.04 results in about a 0.8% reduction in code coverage. Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: introduce a simple seccomp_load() test as part of the non-live testsPaul Moore2019-11-135-3/+105
| | | | | | | | | | | | | | This is a bit controversial as historically we've refrained from doing any tests that rely on the host kernel in the non-live tests, but I think enough time has past that we can do a simple seccomp_load() and not break the world's build/test platforms. The obvious big advantage is we are now testing the basic prctl()/seccomp() filter load infrastructure as part of the main regression test run. Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tools: fix clang problems in scmp_bpf_simPaul Moore2019-11-131-0/+2
| | | | | | | | The clang compiler complains of a potential memory leak, this patch fixes it. Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add some additional test code to boost our code coveragePaul Moore2019-11-133-4/+34
| | | | | Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* api: define __SNR_ppoll againMiroslav Lichvar2019-11-131-0/+7
| | | | | | | | | | Commit bf747eb21e428c2b3ead6ebcca27951b681963a0 accidentally removed the __SNR_ppoll definition. Add it back, using a PNR value if disabled in the kernel headers. Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com> Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* db: add shadow transactionsPaul Moore2019-11-112-1/+127
| | | | | | | | | | | | | | Creating a transaction can be very time consuming on large filters since we create a duplicate filter tree iteratively using the rules supplied by the caller. In an effort to speed this up we introduce the idea of shadow transactions where on a successful transaction commit we preserve the old transaction checkpoint and bring it up to date with the current filter and save it for future use. The next time we start a new transaction we check to see if a shadow transaction exists, if it does we use that instead of creating a new transaction checkpoint from scratch. Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* db: consolidate some of the code which adds rules to a single filterPaul Moore2019-11-111-41/+44
| | | | | | | | Pay back some of the technical debt in db_col_rule_add(), no logic changes in this patch, just removing some code duplication. Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* all: update the CHANGELOG and version for v2.4.2Tom Hromatka2019-11-071-0/+11
| | | | | | Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> (imported from commit aa80299301a9c21a82f5d96911df5a2fbfaf17dd) Signed-off-by: Paul Moore <paul@paul-moore.com>
* tools: ensure a bpf file is specified on the command linePaul Moore2019-11-061-0/+2
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* x86: fix a duplicated shmget/shdt line in the syscall resolution codePaul Moore2019-11-061-2/+0
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: update the internal syscall tables to Linux v5.4-rc4Paul Moore2019-10-3117-142/+1150
| | | | | | | | | | | This is long overdue so quite a few changes, including tweaks to support some newly direct wired syscalls which were previously multiplexed. We really need to make sure we update the syscall table more often. Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
View Lorry Controller Status