Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Optimize seccomp"

Browse Source 
am: 7e812616c9

Change-Id: I6061c25fe18b136d9a4920acd3f54043c44abe4a
This commit is contained in:
Paul Lawrence
2017-02-03 20:19:11 +00:00
committed by android-build-merger
parent 281fae21f8 7e812616c9
commit 9375f3eff6
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
core/jni/android_os_seccomp.cpp
View File

@@ -122,6 +122,10 @@ bool set_seccomp_filter() {
// 64-bit filter // 64-bit filter
ExamineSyscall(f); ExamineSyscall(f);
// arm64-only filter - autogenerated from bionic syscall usage
for (size_t i = 0; i < arm64_filter_size; ++i)
f.push_back(arm64_filter[i]);
// Syscalls needed to boot Android // Syscalls needed to boot Android
AllowSyscall(f, 41); // __NR_pivot_root AllowSyscall(f, 41); // __NR_pivot_root
AllowSyscall(f, 31); // __NR_ioprio_get AllowSyscall(f, 31); // __NR_ioprio_get
@@ -143,9 +147,7 @@ bool set_seccomp_filter() {
// Needed for kernel to restart syscalls // Needed for kernel to restart syscalls
AllowSyscall(f, 128); // __NR_restart_syscall AllowSyscall(f, 128); // __NR_restart_syscall
// arm64-only filter - autogenerated from bionic syscall usage Trap(f);
for (size_t i = 0; i < arm64_filter_size; ++i)
f.push_back(arm64_filter[i]);
if (SetValidateArchitectureJumpTarget(offset_to_32bit_filter, f) != 0) if (SetValidateArchitectureJumpTarget(offset_to_32bit_filter, f) != 0)
return -1; return -1;
@@ -153,6 +155,10 @@ bool set_seccomp_filter() {
// 32-bit filter // 32-bit filter
ExamineSyscall(f); ExamineSyscall(f);
// arm32 filter - autogenerated from bionic syscall usage
for (size_t i = 0; i < arm_filter_size; ++i)
f.push_back(arm_filter[i]);
// Syscalls needed to boot android // Syscalls needed to boot android
AllowSyscall(f, 120); // __NR_clone AllowSyscall(f, 120); // __NR_clone
AllowSyscall(f, 240); // __NR_futex AllowSyscall(f, 240); // __NR_futex
@@ -200,9 +206,7 @@ bool set_seccomp_filter() {
// already allowed. // already allowed.
AllowSyscall(f, 85); // __NR_readlink AllowSyscall(f, 85); // __NR_readlink
// arm32 filter - autogenerated from bionic syscall usage Trap(f);
for (size_t i = 0; i < arm_filter_size; ++i)
f.push_back(arm_filter[i]);
return install_filter(f); return install_filter(f);
} }