armbian/linux
0
0
Fork 0
mirror of https://github.com/armbian/linux.git synced 2026-01-06 10:13:00 -08:00
Code Issues Packages Projects Releases Wiki Activity

seccomp: extract check/assign mode helpers

Browse Source 
To support splitting mode 1 from mode 2, extract the mode checking and
assignment logic into common functions.

Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
This commit is contained in:
Kees Cook
2014-06-25 15:38:02 -07:00
committed by JP Abgrall
parent 6862b01436
commit c208e4e9f1
1 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
kernel/seccomp.c
View File

@@ -219,7 +219,23 @@ static u32 seccomp_run_filters(int syscall)
} }
return ret; return ret;
} }
#endif /* CONFIG_SECCOMP_FILTER */
static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
{
if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
return false;
return true;
}
static inline void seccomp_assign_mode(unsigned long seccomp_mode)
{
current->seccomp.mode = seccomp_mode;
set_tsk_thread_flag(current, TIF_SECCOMP);
}
#ifdef CONFIG_SECCOMP_FILTER
/** /**
* seccomp_attach_filter: Attaches a seccomp filter to current. * seccomp_attach_filter: Attaches a seccomp filter to current.
* @fprog: BPF program to install * @fprog: BPF program to install
@@ -500,8 +516,7 @@ static long seccomp_set_mode(unsigned long seccomp_mode, char __user *filter)
{ {
long ret = -EINVAL; long ret = -EINVAL;
if (current->seccomp.mode && if (!seccomp_may_assign_mode(seccomp_mode))
current->seccomp.mode != seccomp_mode)
goto out; goto out;
switch (seccomp_mode) { switch (seccomp_mode) {
@@ -522,8 +537,7 @@ static long seccomp_set_mode(unsigned long seccomp_mode, char __user *filter)
goto out; goto out;
} }
current->seccomp.mode = seccomp_mode; seccomp_assign_mode(seccomp_mode);
set_thread_flag(TIF_SECCOMP);
out: out:
return ret; return ret;
} }