search for: __nr_socketcall

...to go in. > > -d > > diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c > index af5525ab..6ceee33f 100644 > --- a/sandbox-seccomp-filter.c > +++ b/sandbox-seccomp-filter.c > @@ -223,6 +223,12 @@ static const struct sock_filter preauth_insns[] = { > #ifdef __NR_socketcall > SC_ALLOW_ARG(socketcall, 0, SYS_SHUTDOWN), > #endif > +#if defined(__NR_ioctl) && defined(__s390__) > + /* Allow ioctls for ICA crypto card on s390 */ > + SC_ALLOW_ARG(ioctl, 1, Z90STAT_STATUS_MASK), > + SC_ALLOW_ARG(ioctl, 1, ICARSAMODEXPO), > + SC_ALLOW_ARG(ioctl...

...i3.o libgcc/__negdi2.o diff --git a/usr/klibc/arch/i386/socketcall.S b/usr/klibc/arch/i386/socketcall.S deleted file mode 100644 index 44e2004..0000000 --- a/usr/klibc/arch/i386/socketcall.S +++ /dev/null @@ -1,55 +0,0 @@ -# -# socketcall.S -# -# Socketcalls use the following convention: -# %eax = __NR_socketcall -# %ebx = socketcall number -# %ecx = pointer to arguments (up to 6) -# - -#include <asm/unistd.h> - -#ifdef __i386__ - - .text - .align 4 - .globl __socketcall_common - .type __socketcall_common, @function - -__socketcall_common: - xchgl %ebx,(%esp) # The stub passes the socketcall # on stac...

..._STMT(BPF_LD+BPF_W+BPF_ABS, LO_ARG(_arg_nr)), \ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_arg_val), 0, 1), \ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), \ /* reload syscall number; all rules expect it in accumulator */ \ @@ -207,6 +218,13 @@ static const struct sock_filter preauth_insns[] = { #ifdef __NR_socketcall SC_ALLOW_ARG(socketcall, 0, SYS_SHUTDOWN), #endif +#ifdef __NR_ioctl +#ifdef __s390__ + SC_ALLOW_ARG(ioctl, 1, Z90STAT_STATUS_MASK), + SC_ALLOW_ARG(ioctl, 1, ICARSAMODEXPO), + SC_ALLOW_ARG(ioctl, 1, ICARSACRT), +#endif +#endif /* Default deny */ BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL)...

On 03-03-2017 09:54, Petr Cerny wrote: > Damien Miller wrote: >> On Tue, 28 Feb 2017, Eduardo Barretto wrote: >> >>> On 13-02-2017 13:23, Eduardo Barretto wrote: >>> > This patch enables specific ioctl calls for ICA crypto card on s390 >>> > platform. Without this patch, users using the IBMCA engine are not >>> able >>> > to

Hello all, OpenSSL is using socket() calls (in FIPS mode) when handling ECDSA keys in privsep child. The socket() syscall is already denied in the seccomp filter, but in ppc64le kernel, it is implemented using socketcall() syscall, which is not denied yet (only SYS_SHUTDOWN is allowed) and therefore fails hard. See attached patch with proposed patch (deny is intentionally after allowing the

...+ 4 files changed, 30 insertions(+), 4 deletions(-) diff --git a/usr/klibc/arch/i386/socketcall.S b/usr/klibc/arch/i386/socketcall.S index a40cc02..44e2004 100644 --- a/usr/klibc/arch/i386/socketcall.S +++ b/usr/klibc/arch/i386/socketcall.S @@ -32,7 +32,7 @@ __socketcall_common: #endif movl $__NR_socketcall,%eax - int $0x80 + call *__syscall_entry #ifdef _REGPARM addl $6*4, %esp diff --git a/usr/klibc/arch/i386/syscall.S b/usr/klibc/arch/i386/syscall.S index 0dd363b..b7814e8 100644 --- a/usr/klibc/arch/i386/syscall.S +++ b/usr/klibc/arch/i386/syscall.S @@ -37,7 +37,7 @@ __syscall_common: #endif...

...e __sigreturn,.-__sigreturn diff --git a/usr/klibc/arch/i386/socketcall.S b/usr/klibc/arch/i386/socketcall.S new file mode 100644 index 0000000..816db34 --- /dev/null +++ b/usr/klibc/arch/i386/socketcall.S @@ -0,0 +1,55 @@ +# +# socketcall.S +# +# Socketcalls use the following convention: +# %eax = __NR_socketcall +# %ebx = socketcall number +# %ecx = pointer to arguments (up to 6) +# + +#include <asm/unistd.h> + +#ifdef __i386__ + + .text + .align 4 + .globl __socketcall_common + .type __socketcall_common, @function + +__socketcall_common: + xchgl %ebx,(%esp) # The stub passes the socketcall # on sta...

I have updated the klibc patchset based on feedback received. In particular, the patchset has been reorganized so as not to break git-bisect. Additionally, this updates the patch base to 2.6.17-git12 (d38b69689c349f35502b92e20dafb30c62d49d63) and klibc 1.4.8; the main difference on the klibc side is removal of obsolete code. This is also available as a git tree at: