From 14f31aa647004945043bfdca50b5f3f96f93631b Mon Sep 17 00:00:00 2001 From: Paul Lawrence Date: Thu, 2 Feb 2017 12:42:02 -0800 Subject: [PATCH] Optimize seccomp Bug: 34946764 Test: Make sure boots, seccomp still blocks, and is faster Change-Id: I2b4da512f8a9eb8a32f4435561285d42e4b0395f --- core/jni/android_os_seccomp.cpp | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/core/jni/android_os_seccomp.cpp b/core/jni/android_os_seccomp.cpp index fc35a74697534..75b898e8b63ad 100644 --- a/core/jni/android_os_seccomp.cpp +++ b/core/jni/android_os_seccomp.cpp @@ -122,6 +122,10 @@ bool set_seccomp_filter() { // 64-bit filter ExamineSyscall(f); + // arm64-only filter - autogenerated from bionic syscall usage + for (size_t i = 0; i < arm64_filter_size; ++i) + f.push_back(arm64_filter[i]); + // Syscalls needed to boot Android AllowSyscall(f, 41); // __NR_pivot_root AllowSyscall(f, 31); // __NR_ioprio_get @@ -143,9 +147,7 @@ bool set_seccomp_filter() { // Needed for kernel to restart syscalls AllowSyscall(f, 128); // __NR_restart_syscall - // arm64-only filter - autogenerated from bionic syscall usage - for (size_t i = 0; i < arm64_filter_size; ++i) - f.push_back(arm64_filter[i]); + Trap(f); if (SetValidateArchitectureJumpTarget(offset_to_32bit_filter, f) != 0) return -1; @@ -153,6 +155,10 @@ bool set_seccomp_filter() { // 32-bit filter ExamineSyscall(f); + // arm32 filter - autogenerated from bionic syscall usage + for (size_t i = 0; i < arm_filter_size; ++i) + f.push_back(arm_filter[i]); + // Syscalls needed to boot android AllowSyscall(f, 120); // __NR_clone AllowSyscall(f, 240); // __NR_futex @@ -200,9 +206,7 @@ bool set_seccomp_filter() { // already allowed. AllowSyscall(f, 85); // __NR_readlink - // arm32 filter - autogenerated from bionic syscall usage - for (size_t i = 0; i < arm_filter_size; ++i) - f.push_back(arm_filter[i]); + Trap(f); return install_filter(f); }