Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Optimize seccomp"

Browse Source
This commit is contained in:
Paul Lawrence
2017-02-03 20:14:14 +00:00
committed by Gerrit Code Review
parent e724f82b3d 14f31aa647
commit 7e812616c9
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
core/jni/android_os_seccomp.cpp
View File

@@ -122,6 +122,10 @@ bool set_seccomp_filter() {
// 64-bit filter
ExamineSyscall(f);
// arm64-only filter - autogenerated from bionic syscall usage
for (size_t i = 0; i < arm64_filter_size; ++i)
f.push_back(arm64_filter[i]);
// Syscalls needed to boot Android
AllowSyscall(f, 41); // __NR_pivot_root
AllowSyscall(f, 31); // __NR_ioprio_get
@@ -143,9 +147,7 @@ bool set_seccomp_filter() {
// Needed for kernel to restart syscalls
AllowSyscall(f, 128); // __NR_restart_syscall
// arm64-only filter - autogenerated from bionic syscall usage
for (size_t i = 0; i < arm64_filter_size; ++i)
f.push_back(arm64_filter[i]);
Trap(f);
if (SetValidateArchitectureJumpTarget(offset_to_32bit_filter, f) != 0)
return -1;
@@ -153,6 +155,10 @@ bool set_seccomp_filter() {
// 32-bit filter
ExamineSyscall(f);
// arm32 filter - autogenerated from bionic syscall usage
for (size_t i = 0; i < arm_filter_size; ++i)
f.push_back(arm_filter[i]);
// Syscalls needed to boot android
AllowSyscall(f, 120); // __NR_clone
AllowSyscall(f, 240); // __NR_futex
@@ -200,9 +206,7 @@ bool set_seccomp_filter() {
// already allowed.
AllowSyscall(f, 85); // __NR_readlink
// arm32 filter - autogenerated from bionic syscall usage
for (size_t i = 0; i < arm_filter_size; ++i)
f.push_back(arm_filter[i]);
Trap(f);
return install_filter(f);
}