From edf162e8c360dd578d20a86c4ad79b54747a2d64 Mon Sep 17 00:00:00 2001 From: Jiaheng Hu Date: Tue, 7 Jul 2020 22:56:33 +0000 Subject: sys/linux: add SECCOMP_IOCTL_NOTIF_ADDFD Added the ioctl decsription for adding a fd to a seccomp notifier, currently in linux next. (https://lore.kernel.org/lkml/20200617220327.3731559-7-keescook@chromium.org/) --- sys/linux/seccomp.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'sys/linux/seccomp.txt') diff --git a/sys/linux/seccomp.txt b/sys/linux/seccomp.txt index 3d071eb46..c007c0748 100644 --- a/sys/linux/seccomp.txt +++ b/sys/linux/seccomp.txt @@ -3,6 +3,7 @@ include include +include resource fd_seccomp[fd] resource seccomp_id[int64] @@ -18,6 +19,7 @@ seccomp$SECCOMP_GET_NOTIF_SIZES(op const[SECCOMP_GET_NOTIF_SIZES], flags const[0 ioctl$SECCOMP_IOCTL_NOTIF_RECV(fd fd_seccomp, cmd const[SECCOMP_IOCTL_NOTIF_RECV], arg ptr[out, seccomp_notif]) (breaks_returns) ioctl$SECCOMP_IOCTL_NOTIF_SEND(fd fd_seccomp, cmd const[SECCOMP_IOCTL_NOTIF_SEND], arg ptr[in, seccomp_notif_resp]) (breaks_returns) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(fd fd_seccomp, cmd const[SECCOMP_IOCTL_NOTIF_ID_VALID], arg ptr[in, seccomp_id]) (breaks_returns) +ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(fd fd_seccomp, cmd const[SECCOMP_IOCTL_NOTIF_ADDFD], arg ptr[in, seccomp_notif_addfd]) (breaks_returns) seccomp_notif_sizes { seccomp_notif int16 @@ -46,8 +48,18 @@ seccomp_notif_resp { flags const[0, int32] } +seccomp_notif_addfd { + id seccomp_id + flags flags[seccomp_addfd_flags, int32] + srcfd fd + newfd int32 + newfd_flags flags[seccomp_addfd_newfd_flags, int32] +} + seccomp_flags = 0, SECCOMP_FILTER_FLAG_TSYNC, SECCOMP_FILTER_FLAG_LOG, SECCOMP_FILTER_FLAG_SPEC_ALLOW seccomp_flags_listener = SECCOMP_FILTER_FLAG_NEW_LISTENER, SECCOMP_FILTER_FLAG_LOG_LISTENER, SECCOMP_FILTER_FLAG_SPEC_ALLOW_LISTENER +seccomp_addfd_flags = SECCOMP_ADDFD_FLAG_SETFD +seccomp_addfd_newfd_flags = O_CLOEXEC define SECCOMP_FILTER_FLAG_LOG_LISTENER SECCOMP_FILTER_FLAG_LOG | SECCOMP_FILTER_FLAG_NEW_LISTENER define SECCOMP_FILTER_FLAG_SPEC_ALLOW_LISTENER SECCOMP_FILTER_FLAG_SPEC_ALLOW | SECCOMP_FILTER_FLAG_NEW_LISTENER -- cgit mrf-deployment