Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Optimize seccomp

Browse Source 
Bug: 34946764
Test: Make sure boots, seccomp still blocks, and is faster
Change-Id: I2b4da512f8a9eb8a32f4435561285d42e4b0395f
This commit is contained in:
Paul Lawrence
2017-02-02 12:42:02 -08:00
parent e724f82b3d
commit 14f31aa647
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
core/jni/android_os_seccomp.cpp
View File

@@ -122,6 +122,10 @@ bool set_seccomp_filter() {
// 64-bit filter
ExamineSyscall(f);
// arm64-only filter - autogenerated from bionic syscall usage
for (size_t i = 0; i < arm64_filter_size; ++i)
f.push_back(arm64_filter[i]);
// Syscalls needed to boot Android
AllowSyscall(f, 41); // __NR_pivot_root
AllowSyscall(f, 31); // __NR_ioprio_get
@@ -143,9 +147,7 @@ bool set_seccomp_filter() {
// Needed for kernel to restart syscalls
AllowSyscall(f, 128); // __NR_restart_syscall
// arm64-only filter - autogenerated from bionic syscall usage
for (size_t i = 0; i < arm64_filter_size; ++i)
f.push_back(arm64_filter[i]);
Trap(f);
if (SetValidateArchitectureJumpTarget(offset_to_32bit_filter, f) != 0)
return -1;
@@ -153,6 +155,10 @@ bool set_seccomp_filter() {
// 32-bit filter
ExamineSyscall(f);
// arm32 filter - autogenerated from bionic syscall usage
for (size_t i = 0; i < arm_filter_size; ++i)
f.push_back(arm_filter[i]);
// Syscalls needed to boot android
AllowSyscall(f, 120); // __NR_clone
AllowSyscall(f, 240); // __NR_futex
@@ -200,9 +206,7 @@ bool set_seccomp_filter() {
// already allowed.
AllowSyscall(f, 85); // __NR_readlink
// arm32 filter - autogenerated from bionic syscall usage
for (size_t i = 0; i < arm_filter_size; ++i)
f.push_back(arm_filter[i]);
Trap(f);
return install_filter(f);
}