• D
    seccomp, filter: add and use bpf_prog_create_from_user from seccomp · ac67eb2c
    Daniel Borkmann 提交于
    Seccomp has always been a special candidate when it comes to preparation
    of its filters in seccomp_prepare_filter(). Due to the extra checks and
    filter rewrite it partially duplicates code and has BPF internals exposed.
    
    This patch adds a generic API inside the BPF code code that seccomp can use
    and thus keep it's filter preparation code minimal and better maintainable.
    The other side-effect is that now classic JITs can add seccomp support as
    well by only providing a BPF_LDX | BPF_W | BPF_ABS translation.
    
    Tested with seccomp and BPF test suites.
    Signed-off-by: NDaniel Borkmann <daniel@iogearbox.net>
    Cc: Nicolas Schichan <nschichan@freebox.fr>
    Cc: Alexei Starovoitov <ast@plumgrid.com>
    Cc: Kees Cook <keescook@chromium.org>
    Acked-by: NAlexei Starovoitov <ast@plumgrid.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    ac67eb2c
seccomp.c 23.0 KB