UBUNTU: SAUCE: SECCOMP: sk_run_filter: add BPF_S_ANC_SECCOMP_LD_W

Introduces a new BPF ancillary instruction that all LD calls will be
mapped through when skb_run_filter() is being used for seccomp BPF.  The
rewriting will be done using a secondary chk_filter function that is run
after skb_chk_filter.

The code change is guarded by CONFIG_SECCOMP_FILTER which is added,
along with the seccomp_bpf_load() function later in this series.

This is based on http://lkml.org/lkml/2012/3/2/141

v15: include seccomp.h explicitly for when seccomp_bpf_load exists.
v14: First cut using a single additional instruction
... v13: made bpf functions generic.

Suggested-by: Indan Zupancic <indan@nul.nu>
Signed-off-by: Will Drewry <wad@chromium.org>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Kees Cook <kees@ubuntu.com>

diff --git a/include/linux/filter.h b/include/linux/filter.h
index 8eeb205..aaa2e80 100644 (file)
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -228,6 +228,7 @@ enum {
        BPF_S_ANC_HATYPE,
        BPF_S_ANC_RXHASH,
        BPF_S_ANC_CPU,
+       BPF_S_ANC_SECCOMP_LD_W,
 };
 
 #endif /* __KERNEL__ */

diff --git a/net/core/filter.c b/net/core/filter.c
index 5dea452..d775edc 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -39,6 +39,7 @@
 #include <linux/filter.h>
 #include <linux/reciprocal_div.h>
 #include <linux/ratelimit.h>
+#include <linux/seccomp.h>
 
 /* No hurry in this branch */
 static void *__load_pointer(const struct sk_buff *skb, int k, unsigned int size)
@@ -350,6 +351,11 @@ load_b:
                                A = 0;
                        continue;
                }
+#ifdef CONFIG_SECCOMP_FILTER
+               case BPF_S_ANC_SECCOMP_LD_W:
+                       A = seccomp_bpf_load(fentry->k);
+                       continue;
+#endif
                default:
                        WARN_RATELIMIT(1, "Unknown code:%u jt:%u tf:%u k:%u\n",
                                       fentry->code, fentry->jt,