git/linux-nf
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git synced 2026-04-18 06:34:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

syscall_user_dispatch: Add PR_SYS_DISPATCH_INCLUSIVE_ON

Browse Source 
There are two possible scenarios for syscall filtering:
 - having a trusted/allowed range of PCs, and intercepting everything else
 - or the opposite: a single untrusted/intercepted range and allowing
   everything else (this is relevant for any kind of sandboxing scenario,
   or monitoring behavior of a single library)

The current API only allows the former use case due to allowed
range wrap-around check. Add PR_SYS_DISPATCH_INCLUSIVE_ON that
enables the second use case.

Add PR_SYS_DISPATCH_EXCLUSIVE_ON alias for PR_SYS_DISPATCH_ON
to make it clear how it's different from the new
PR_SYS_DISPATCH_INCLUSIVE_ON.

Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/all/97947cc8e205ff49675826d7b0327ef2e2c66eea.1747839857.git.dvyukov@google.com
This commit is contained in:
Dmitry Vyukov
2025-05-21 17:04:29 +02:00
committed by Thomas Gleixner
parent b89732c8c8
commit a2fc422ed7
4 changed files with 48 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
include/uapi/linux/prctl.h
View File

@@ -255,7 +255,12 @@ struct prctl_mm_map {
/* Dispatch syscalls to a userspace handler */
#define PR_SET_SYSCALL_USER_DISPATCH 59
# define PR_SYS_DISPATCH_OFF 0
# define PR_SYS_DISPATCH_ON 1
/* Enable dispatch except for the specified range */
# define PR_SYS_DISPATCH_EXCLUSIVE_ON 1
/* Enable dispatch for the specified range */
# define PR_SYS_DISPATCH_INCLUSIVE_ON 2
/* Legacy name for backwards compatibility */
# define PR_SYS_DISPATCH_ON PR_SYS_DISPATCH_EXCLUSIVE_ON
/* The control values for the user space selector when dispatch is enabled */
# define SYSCALL_DISPATCH_FILTER_ALLOW 0
# define SYSCALL_DISPATCH_FILTER_BLOCK 1