• Tycho Andersen's avatar
    seccomp: allow TSYNC and USER_NOTIF together · 51891498
    Tycho Andersen authored
    The restriction introduced in 7a0df7fb ("seccomp: Make NEW_LISTENER and
    TSYNC flags exclusive") is mostly artificial: there is enough information
    in a seccomp user notification to tell which thread triggered a
    notification. The reason it was introduced is because TSYNC makes the
    syscall return a thread-id on failure, and NEW_LISTENER returns an fd, and
    there's no way to distinguish between these two cases (well, I suppose the
    caller could check all fds it has, then do the syscall, and if the return
    value was an fd that already existed, then it must be a thread id, but
    bleh).
    
    Matthew would like to use these two flags together in the Chrome sandbox
    which wants to use TSYNC for video drivers and NEW_LISTENER to proxy
    syscalls.
    
    So, let's fix this ugliness by adding another flag, TSYNC_ESRCH, which
    tells the kernel to just return -ESRCH on a TSYNC error. This way,
    NEW_LISTENER (and any subsequent seccomp() commands that want to return
    positive values) don't conflict with each other.
    Suggested-by: default avatarMatthew Denton <mpdenton@google.com>
    Signed-off-by: default avatarTycho Andersen <tycho@tycho.ws>
    Link: https://lore.kernel.org/r/20200304180517.23867-1-tycho@tycho.wsSigned-off-by: default avatarKees Cook <keescook@chromium.org>
    51891498
seccomp.c 46.4 KB