CONFIG_SECCOMP missing on ARM

[Kees Cook]

PR_SET_SECCOMP (see man prctl) does not work correctly on ARM. The CONFIG_SECCOMP is not defined (and is not listed in Kconfig). It is not an arch-specific feature (see kernel/seccomp.c).

$ git grep 'config SECCOMP' | cat
arch/mips/Kconfig:config SECCOMP
arch/powerpc/Kconfig:config SECCOMP
arch/sh/Kconfig:config SECCOMP
arch/sparc/Kconfig:config SECCOMP
arch/x86/Kconfig:config SECCOMP

[Evan Martin (Chromium) (evan-chromium)]

This will soon become a requirement for Chromium.

[Amit Kucheria (amitk)]

This is not just a config issue, it is a lack of hooking up SECCOMP thread flag in ARM. I've got a kernel patch that now compiles, but I will need some hand-holding on testing it. As I understood SECCOMP, it is used to restrict access to the syscalls that a process thread can make to the following - read, write, exit and sigreturn.

Do you have a sample program that will allow me to test if other syscalls are being permitted or not?

[Kees Cook (kees)]

http://bazaar.launchpad.net/~ubuntu-bugcontrol/qa-regression-testing/master/files/head%3A/scripts/kernel-security/seccomp/

[Amit Kucheria (amitk)]

Committed to linaro kernel and sent upstream by Nico