summaryrefslogtreecommitdiff
path: root/src/arch.c
Commit message (Collapse)AuthorAgeFilesLines
* all: massive src/db.c reworkPaul Moore2018-01-171-53/+28
| | | | | | | | | | | | | | | | | | | First, and most importantly, let me state that this is perhaps the worst possible example of a patch I can think of, and if anyone tries to submit a PR/patch like this one I will reject it almost immediately. I'm only merging this because 1) this patch escalated quickly, 2) splitting it would require a disproportionate amount of time, and 3) this effort had blocked other work for too long ... and, well, I'm the maintainer. Consider this a bit of "maintainer privilege" if you will. This patch started simply enough: the goal was to add/augment some tests to help increase the libseccomp test coverage. Unfortunately, this particular test improvement uncovered a rather tricky bug which escalated quite quickly and soon involved a major rework of how we build the filter tree in src/db.c. This rework brought about changes throughout the repository, including the transaction and ABI specific code. Signed-off-by: Paul Moore <paul@paul-moore.com>
* all: treat syscall -1 as a valid syscallPaul Moore2017-02-211-9/+9
| | | | | | | | | | | | | Process tracers use a -1 syscall value to indicate that a syscall should be skipped. This turns out to be quite an undertaking as we need to workaround __NR_SCMP_ERROR (which also has a value of -1). Pay special attention to the new attribute, SCMP_FLTATR_API_TSKIP, and the documentation additions. More information in the GitHub issue: * https://github.com/seccomp/libseccomp/issues/80 Signed-off-by: Paul Moore <paul@paul-moore.com>
* db: include the arguments in the db_api_rule_list structPaul Moore2017-02-171-25/+2
| | | | | | | | | | Instead of dynamically allocating a variable number of arguments, include an array of ARG_COUNT_MAX elements directly in the struct. Also perform a number of simplifications to the code with the understanding that ARG_COUNT_MAX is an ABI independent value that isn't variable. Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: Add parisc architecture supportHelge Deller2016-05-251-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch (v4) adds support for the parisc and parisc64 architectures to libseccomp. I didn't split up the patch, because it's pretty trivial. Those parisc-specific files gets added: src/arch-parisc-syscalls.c src/arch-parisc.c src/arch-parisc.h src/arch-parisc64.c All other changes are trivial because they simply add parisc-specific case statements in variouse switch statements. I did ran a "make check" on x86-64 and parisc and all testcases succeeded. All live testcases succeed as well when running "./regression -T live". The patch applies cleanly to current libseccomp git head. Changes between v4 and v3 of this patch: - Added parisc arch to arch-syscall-check.c and fixup syscall table as needed - Fixed copyright notices in parisc files as suggested by Mike Frysinger Changes between v3 and v2 of this patch: - Stripped out patch which reports if a check was skipped because valgrind isn't installed. - Added tuxcall pseudo syscall for 19-sim-missing_syscalls testcase - Added sysmips pseudo syscall for 29-sim-pseudo_syscall testcase Changes between v2 and v1 of this patch: - Enabled seccomp mode 2 regression tests on parisc. Kernel support for hppa was added in kernel 4.6-rc1 and backported into the kernel v4.5.2 stable series. Signed-off-by: Helge Deller <deller@gmx.de> [PM: corrected a number or errors from 'make check-syntax'] Signed-off-by: Paul Moore <paul@paul-moore.com>
* all: update my email addressPaul Moore2016-02-111-1/+1
| | | | | | | Employer agnostic emails make things a lot easier in the long run so make sure the paul-moore.com address is used whenever it makes sense. Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: generate both multiplexed and direct socket syscall rulesPaul Moore2016-02-091-3/+4
| | | | | | | | | Linux 4.3 added direct-wired socket syscalls in addition to the multiplexed socket syscalls available via socketcall(). This patch causes libseccomp to generate filters for socket syscall methods on x86 systems. Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: enable more involved arch/ABI specific rule creationPaul Moore2016-02-091-60/+9
| | | | | | | Create the infrastructure for arch/ABI specific rule creation that allows us much more involved arch/ABI customization. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: move the low level filter rule addition code into the arch layerPaul Moore2016-02-091-2/+102
| | | | | | | | | | | | | The arch specific filter rewrite code is going to need to become more complex so move the low level rule addition code directly into the arch layer instead of the db layer, but still keep the tree manipulation code in the db layer. This patch also creates a new arch specific rule_add() function table entry and allows for this function to create multiple rules from a single rule. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: make use of function tables instead of switch statementsPaul Moore2016-02-091-67/+8
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* db: store the rules used to build the filterPaul Moore2016-02-091-7/+6
| | | | | | | This will be useful in future patches for rebuilding and manipulating the filter. Signed-off-by: Paul Moore <pmoore@redhat.com>
* Merge branch 'working-s390' into masterPaul Moore2015-08-281-9/+31
|\ | | | | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
| * s390x: fix plattform detectionJan Willeke2015-07-131-2/+2
| | | | | | | | | | | | | | | | | | Because on S390x both __s390x__ and __s390__ are defined, the check of __s390x__ must be before __s390__. Signed-off-by: Jan Willeke <willeke@linux.vnet.ibm.com> [PM: subject tweaks] Signed-off-by: Paul Moore <pmoore@redhat.com>
| * arch: add support for s390Jan Willeke2015-07-131-0/+11
| | | | | | | | | | | | | | | | This patch adds support for S390 (32-bit) architecture. Signed-off-by: Jan Willeke <willeke@linux.vnet.ibm.com> [PM: rewrote the subject line, style fixes, s390x/s390 typo bugfixes] Signed-off-by: Paul Moore <pmoore@redhat.com>
| * arch: add support for s390xJan Willeke2015-07-131-0/+11
| | | | | | | | | | | | | | | | This patch adds support for S390x (64-bit) architecture. Signed-off-by: Jan Willeke <willeke@linux.vnet.ibm.com> [PM: rewrote the subject line, style fixes] Signed-off-by: Paul Moore <pmoore@redhat.com>
* | all: block negative syscall numbers from the filterPaul Moore2015-08-271-16/+14
| | | | | | | | | | | | | | | | | | | | | | We use negative syscalls numbers to indicate syscalls that aren't supported by a certain arch/ABI and unfortunately there were cases where these bogus syscall values were finding their way into the filter. This patch corrects this and adds a new test to check for this in the future. Reported-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Paul Moore <pmoore@redhat.com>
* | Merge branch 'working-ppc64'Paul Moore2015-08-051-0/+32
|\ \ | |/ |/| | | | | | | Mike Strosaker <strosake@linux.vnet.ibm.com> reports that the working-ppc64 branch is working for both 'make check' and './regression -T live'.
| * arch: add basic initial ppc support to the arch-dependent codeBogdan Purcareata2015-02-171-0/+11
| | | | | | | | | | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
| * arch: add the basic initial support for ppc64 to the arch-dependent codePaul Moore2015-02-061-0/+21
| | | | | | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* | docs: fix a number of problems in the function header commentsPaul Moore2015-05-091-1/+1
|/ | | | | Reported-by: Brian Cain <brian.cain@gmail.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: perform a number of simplications in the arch codePaul Moore2014-08-271-83/+27
| | | | | | | | | I've been putting off simplifing the arch specific code until we had enough ABIs to know what simplifications made sense. Well, our supported ABI list is not quite reasonable so go ahead and clean things up a bit. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: Add AArch64 supportMarcin Juszkiewicz2014-08-271-0/+20
| | | | | | | | This patch adds support for AArch64 (64-bit ARM) architecture. Signed-off-by: Marcin Juszkiewicz <mjuszkiewicz@redhat.com> (Additional fixes/corrections/etc.) Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: Handle MIPS code only on MIPS platformsMarcin Juszkiewicz2014-08-211-3/+3
| | | | | | | | MIPS stuff needs to be handled on MIPS platforms otherwise no new architectures can be added after MIPS block. Signed-off-by: Marcin Juszkiewicz <mjuszkiewicz@redhat.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: add mips64n32 supportPaul Moore2014-08-201-0/+30
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: add mips64 supportPaul Moore2014-08-201-1/+41
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add the seccomp_arch_resolve_name() API callPaul Moore2014-05-071-0/+25
| | | | | | As requested by the systemd developers and used by our own tools. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: Add support for MIPS Little EndianMarkos Chandras2014-04-151-0/+10
| | | | | | | Add support for MIPS 32-bit (O32 ABI) Little Endian Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: Add support for MIPS Big EndianMarkos Chandras2014-04-151-0/+14
| | | | | | | Add support for MIPS 32-bit (O32 ABI) Big Endian Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
* all: resolve issues caused by big endian systemsPaul Moore2014-02-091-0/+26
| | | | | | | | | | | | | | There are two major issues resolved in this patch: proper support for generating BPF on big endian systems, and ensuring we build the BPF correctly when the host system does not share the same endianess as the target platform. Relevant discussion in LKML regarding BPF on big endian systems: https://lkml.org/lkml/2012/4/8/87 Inspired by an earlier patch from Markos Chandras. Signed-off-by: Paul Moore <pmoore@redhat.com>
* all: convert some booleans from ints to boolsPaul Moore2013-04-191-4/+3
| | | | | | Make it more obvious that these variables are booleans. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: remove direct access to the syscall tablesPaul Moore2013-03-261-46/+19
| | | | | | | | We may not always want to have statically defined syscall tables, e.g. x32, so create a series of functions to access the syscall tables which should provide us some flexibility. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: rename arch-i386* to arch-x86*Paul Moore2013-03-261-8/+7
| | | | | | | No code chanages here, just an effort to improve naming consistency a bit. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: add basic ARM supportPaul Moore2013-03-261-8/+13
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: add basic x32 supportPaul Moore2013-03-261-0/+14
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: disconnect the BPF arch token from the libseccomp tokenPaul Moore2013-03-261-34/+16
| | | | | | | | | Unfortunately, the x32 ABI shares the same architecture token with x86_64 in the kernel so we need to separate the arch token we use in the BPF filter with the arch token we use for idenitfying the arch/ABI to libseccomp callers. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: ensure full syscall coverage across x86 and x86_64Paul Moore2013-01-211-13/+51
| | | | | | This patch ensures that you can create non-native filters using syscalls not present in the native architecture. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add support for multiple architecturesPaul Moore2012-09-271-3/+42
| | | | | | | | | Add the seccomp_arch_add() and seccomp_arch_remove() functions to add and remove architectures from the filter. This patch also adds the seccomp_merge() function which merges two filter contexts together assuming there is no architecture conflicts. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: provide the basic infrastructure for non-native architecture supportPaul Moore2012-09-271-18/+55
| | | | | | | Add the arch_syscall_translate() function which converts the syscall table from the native architecture to the desired architecture. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: add support for syscall name resolutionPaul Moore2012-09-271-0/+73
| | | | | | Provide syscall name to syscall number resolution. Signed-off-by: Paul Moore <pmoore@redhat.com>
* all: relicense the library from GPLv2 to LGPLv2.1Paul Moore2012-04-091-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From the libseccomp-discuss mailing list: On Monday, April 09, 2012 06:06:51 PM Paul Moore wrote: > Hello, > > It was suggested on the libseccomp announcement thread that we > relicense the library from GPLv2 to LGPLv2.1. In my opinion this > makes sense and I recommend we relicense the library, can I have > your permission to relicense your contributions? > > * LGPLv2.1 > -> http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html On Tuesday, April 10, 2012 10:07:37 AM Eric Paris wrote: > You have my permission to relicense to LGPL. On Tuesday, April 10, 2012 10:27:39 AM Ashley Lai wrote: > Yes, you have my permission to relicense to LGPL. On Tuesday, April 10, 2012 11:48:14 AM Corey Bryant wrote: > We (IBM) have OSSC approval now. You have my approval to > relicense my contributions to LGPLv2.1. On Tuesday, April 10, 2012 12:57:25 PM Eduardo Otubo wrote: > On Tue, Apr 10, 2012 at 11:48:14AM -0400, Corey Bryant wrote: > > We (IBM) have OSSC approval now. You have my approval to > > relicense my contributions to LGPLv2.1. > > Exactly, not a problem for me. Signed-off-by: Paul Moore <pmoore@redhat.com>
* all: use the system header files when possiblePaul Moore2012-04-021-23/+1
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: enable less strict filter rewritesPaul Moore2012-03-291-3/+7
| | | | | | | | | | | | At present we fail if we can't completely preserve the caller's filter, while admirable, this does require some knowledge of the architecture to ensure you're adding a "correct" rule. In keeping with our goal of architecture independence, we want to add the ability to do "best effort" rewrites that preserve as much of the original filter rule as possible. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: provide syscall rewriting functionsPaul Moore2012-03-271-0/+20
| | | | | | | We have a filter rewriting function but we also need a syscall rewriting function. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: simplify the arch dependent code quite a bitPaul Moore2012-03-091-8/+7
| | | | | | | | In the majority of the cases, we don't need to implement full functions when a simple #define will work. We also probably don't need to pass as many arguments as we are at present. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: add basic support for pseudo syscallsPaul Moore2012-03-091-0/+24
| | | | | | | | | This is obviously not a working example, but it lays the foundation for providing working syscall and argument chain rewriting. This functionality can be used both for the x86/socketcall() case as well as non-native BPF code generation. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: make SCMP_ARG_MAX an arch dependent valuePaul Moore2012-03-091-0/+20
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: add x86_64 specific filesPaul Moore2012-03-091-1/+11
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: add to the basic framework and introduce i386 specific filesPaul Moore2012-03-091-0/+56
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: set the arch_def->token valuePaul Moore2012-03-091-1/+10
| | | | | | | | | | Unfortunately, there doesn't appear to be a great way to detect this, so we need to depend on some GCC specific pre-processor #defines. For reasons that should be obvious, we also change the default compiler from whatever make provides via "$(CC)" to "gcc". Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: introduce a single place for all the machine dependent codePaul Moore2012-03-091-0/+43
Signed-off-by: Paul Moore <pmoore@redhat.com>
View Lorry Controller Status