Home
last modified time | relevance | path

Searched refs:seccomp (Results 1 – 25 of 41) sorted by relevance

12

/linux/Documentation/translations/zh_CN/userspace-api/
H A Dseccomp_filter.rst29 此外，BPF让seccomp用户不再成为在系统调用干预框架（system call interposition
45 添加了一个额外的seccomp模式，它可以使用和严格seccomp相同的 prctl(2) 调用来启用。
76 一个seccomp过滤器可能返回下列任意值。如果多个过滤器存在，评估一个指定系统调用的
100 由seccomp触发的 ``SIGSYS`` 会有一个 ``SYS_SECCOMP`` 的 si_code 。
121 在追踪器被通知后，seccomp检查不会再次运行。（这意味着基于seccomp的沙箱必须禁止
149 ``samples/seccomp/`` 文件夹包含了x86专用和更通用的使用高层宏接口来生成BPF程序的
155 ``SECCOMP_RET_USER_NOTIF`` 返回值会让seccomp过滤器传递一个特定的系统调用给用户
159 传递 ``SECCOMP_FILTER_FLAG_NEW_LISTENER`` 参数给 ``seccomp()`` 系统调用可以取
164 fd = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_NEW_LISTENER, &prog);
171 seccomp通知文件描述符由两个结构体组成：
[all …]
H A Dno_new_privs.rst46 - 为seccomp模式2沙箱安装的过滤器会跨execve持久化，并能够改变新执行程序的行为。
/linux/kernel/
H A Dseccomp.c3 * linux/kernel/seccomp.c
16 #define pr_fmt(fmt) "seccomp: " fmt
27 #include <linux/seccomp.h>
69 * The seccomp data. This pointer is valid the entire time this
92 * dying, a new seccomp addfd message, or changing to REPLIED
136 * struct notification - container for seccomp userspace notifications. Since
137 * most seccomp filters will not have notification listeners attached and this
158 * struct action_cache - per-filter cache of seccomp actions per
189 * struct seccomp_filter - container for seccomp BPF programs
216 * with current->seccomp
2126 SYSCALL_DEFINE3(seccomp,unsigned int,op,unsigned int,flags,void __user *,uargs) SYSCALL_DEFINE3() argument
[all...]
/linux/Documentation/userspace-api/
H A Dseccomp_filter.rst24 Additionally, BPF makes it impossible for users of seccomp to fall prey
46 An additional seccomp mode is added and is enabled using the same
47 prctl(2) call as the strict seccomp. If the architecture has
87 A seccomp filter may return any of the following values. If multiple
119 ``SIGSYS`` triggered by seccomp will have a si_code of ``SYS_SECCOMP``.
149 The seccomp check will not be run again after the tracer is
150 notified. (This means that seccomp-based sandboxes MUST NOT
187 The ``samples/seccomp/`` directory contains both an x86-specific example
194 The ``SECCOMP_RET_USER_NOTIF`` return code lets seccomp filters pass a
200 argument to the ``seccomp()`` syscall:
[all …]
H A Dno_new_privs.rst47 - Filters installed for the seccomp mode 2 sandbox persist across
/linux/include/linux/
H A Dseccomp_types.h22 struct seccomp { struct
30 struct seccomp { }; struct
/linux/arch/um/kernel/skas/
H A Dstub_exe.c50 if (!init_data.seccomp) in real_init()
72 if (init_data.seccomp) { in real_init()
85 if (!init_data.seccomp) { in real_init()
132 if (init_data.seccomp) { in real_init()
/linux/tools/testing/selftests/seccomp/
H A Dseccomp_bpf.c310 #ifndef seccomp
311 int seccomp(unsigned int op, unsigned int flags, void *args) in seccomp() function
863 ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, in kill_thread_or_group()
872 ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread)); in kill_thread_or_group()
2145 FIXTURE_VARIANT_ADD(TRACE_syscall, seccomp) { in FIXTURE_VARIANT_ADD() argument
2344 ret = seccomp(-1, 0, &prog); in TEST()
2353 ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL); in TEST()
2357 ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog); in TEST()
2363 ret = seccomp(SECCOMP_SET_MODE_FILTER, -1, &prog); in TEST()
2367 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL); in TEST()
[all …]
/linux/samples/seccomp/
H A Duser-trap.c26 static int seccomp(unsigned int op, unsigned int flags, void *args) in seccomp() function
105 return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog); in user_trap_syscall()
297 if (seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes) < 0) { in main()
/linux/tools/perf/bench/
H A Dsched-seccomp-notify.c44 static int seccomp(unsigned int op, unsigned int flags, void *args) in seccomp() function
64 return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog); in user_notif_syscall()
H A DBuild3 perf-bench-y += sched-seccomp-notify.o
/linux/arch/um/include/shared/skas/
H A Dstub-data.h21 int seccomp; member
/linux/Documentation/translations/zh_CN/security/
H A Dself-protection.rst102 “seccomp”系统为用户空间提供了一种可选功能，提供了一种减少可供
/linux/include/uapi/linux/
H A Dptrace.h104 } seccomp; member
/linux/samples/
H A DMakefile22 subdir-$(CONFIG_SAMPLE_SECCOMP) += seccomp
H A DKconfig177 bool "Build seccomp sample code"
180 Build samples of seccomp filters using various methods of
/linux/arch/mips/kernel/
H A Dscall64-n32.S79 bltz v0, 1f # seccomp failed? Skip syscall
H A Dscall64-n64.S89 bltz v0, 1f # seccomp failed? Skip syscall
H A Dscall64-o32.S134 bltz v0, 1f # seccomp failed? Skip syscall
H A Dscall32-o32.S131 bltz v0, 1f # seccomp failed? Skip syscall
/linux/rust/
H A Dbindgen_parameters33 # `seccomp`'s comment gets understood as a doctest
/linux/init/
H A Dinit_task.c265 .seccomp = { .filter_count = ATOMIC_INIT(0) },
/linux/tools/testing/selftests/
H A DMakefile114 TARGETS += seccomp
/linux/arch/m68k/kernel/
H A Dentry.S214 | seccomp filter active?
/linux/Documentation/bpf/
H A Dclassic_vs_extended.rst207 its content is defined by a specific use case. For seccomp register R1 points
226 optimizations, socket filters and seccomp are using it as assembler. Tracing

12