{"push_id":644416194,"size":26,"distinct_size":1,"ref":"refs/heads/cm-11.0","head":"8f24abe55c6f99121065a5fbae7099e65de9675f","before":"f1cb40cdeb4aefcad9597b1f15facaaa9183af3f","commits":[{"sha":"9600f87bf2e870f837484dcdc1162cf8ea1a324e","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"selinux: Report permissive mode in avc: denied messages.\n\nWe cannot presently tell from an avc: denied message whether access was in\nfact denied or was allowed due to global or per-domain permissive mode.\nAdd a permissive= field to the avc message to reflect this information.\n\nChange-Id: I23adf43e417687f1da7354d392d37f5fabbd805e\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/9600f87bf2e870f837484dcdc1162cf8ea1a324e"},{"sha":"b3d4b922aee52703653d866afff35f91dd032e07","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"seccomp: kill the seccomp_t typedef\n\nReplaces the seccomp_t typedef with struct seccomp to match modern\nkernel style.\n\nSigned-off-by: Will Drewry <wad@chromium.org>\nReviewed-by: James Morris <jmorris@namei.org>\nAcked-by: Serge Hallyn <serge.hallyn@canonical.com>\nAcked-by: Eric Paris <eparis@redhat.com>\n\nv18: rebase\n...\nv14: rebase/nochanges\nv13: rebase on to 88ebdda6159ffc15699f204c33feb3e431bf9bdc\nv12: rebase on to linux-next\nv8-v11: no changes\nv7: struct seccomp_struct -> struct seccomp\nv6: original inclusion in this series.\n\nConflicts:\n\tinclude/linux/sched.h","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/b3d4b922aee52703653d866afff35f91dd032e07"},{"sha":"a4878726c56ea743335e57fcd7460c48782143cc","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"seccomp: add system call filtering using BPF\n\n[This patch depends on luto@mit.edu's no_new_privs patch:\n   https://lkml.org/lkml/2012/1/30/264\n The whole series including Andrew's patches can be found here:\n   https://github.com/redpig/linux/tree/seccomp\n Complete diff here:\n   https://github.com/redpig/linux/compare/1dc65fed...seccomp\n]\n\nThis patch adds support for seccomp mode 2.  Mode 2 introduces the\nability for unprivileged processes to install system call filtering\npolicy expressed in terms of a Berkeley Packet Filter (BPF) program.\nThis program will be evaluated in the kernel for each system call\nthe task makes and computes a result based on data in the format\nof struct seccomp_data.\n\nA filter program may be installed by calling:\n  struct sock_fprog fprog = { ... };\n  ...\n  prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &fprog);\n\nThe return value of the filter program determines if the system call is\nallowed to proceed or denied.  If the first filter program installed\nallows prctl(2) calls, then the above call may be made repeatedly\nby a task to further reduce its access to the kernel.  All attached\nprograms must be evaluated before a system call will be allowed to\nproceed.\n\nFilter programs will be inherited across fork/clone and execve.\nHowever, if the task attaching the filter is unprivileged\n(!CAP_SYS_ADMIN) the no_new_privs bit will be set on the task.  This\nensures that unprivileged tasks cannot attach filters that affect\nprivileged tasks (e.g., setuid binary).\n\nThere are a number of benefits to this approach. A few of which are\nas follows:\n- BPF has been exposed to userland for a long time\n- BPF optimization (and JIT'ing) are well understood\n- Userland already knows its ABI: system call numbers and desired\n  arguments\n- No time-of-check-time-of-use vulnerable data accesses are possible.\n- system call arguments are loaded on access only to minimize copying\n  required for system call policy decisions.\n\nMode 2 support is restricted to architectures that enable\nHAVE_ARCH_SECCOMP_FILTER.  In this patch, the primary dependency is on\nsyscall_get_arguments().  The full desired scope of this feature will\nadd a few minor additional requirements expressed later in this series.\nBased on discussion, SECCOMP_RET_ERRNO and SECCOMP_RET_TRACE seem to be\nthe desired additional functionality.\n\nNo architectures are enabled in this patch.\n\nSigned-off-by: Will Drewry <wad@chromium.org>\nAcked-by: Serge Hallyn <serge.hallyn@canonical.com>\nReviewed-by: Indan Zupancic <indan@nul.nu>\nAcked-by: Eric Paris <eparis@redhat.com>\n\nv18: - rebase to v3.4-rc2\n     - s/chk/check/ (akpm@linux-foundation.org,jmorris@namei.org)\n     - allocate with GFP_KERNEL|__GFP_NOWARN (indan@nul.nu)\n     - add a comment for get_u32 regarding endianness (akpm@)\n     - fix other typos, style mistakes (akpm@)\n     - added acked-by\nv17: - properly guard seccomp filter needed headers (leann@ubuntu.com)\n     - tighten return mask to 0x7fff0000\nv16: - no change\nv15: - add a 4 instr penalty when counting a path to account for seccomp_filter\n       size (indan@nul.nu)\n     - drop the max insns to 256KB (indan@nul.nu)\n     - return ENOMEM if the max insns limit has been hit (indan@nul.nu)\n     - move IP checks after args (indan@nul.nu)\n     - drop !user_filter check (indan@nul.nu)\n     - only allow explicit bpf codes (indan@nul.nu)\n     - exit_code -> exit_sig\nv14: - put/get_seccomp_filter takes struct task_struct\n       (indan@nul.nu,keescook@chromium.org)\n     - adds seccomp_chk_filter and drops general bpf_run/chk_filter user\n     - add seccomp_bpf_load for use by net/core/filter.c\n     - lower max per-process/per-hierarchy: 1MB\n     - moved nnp/capability check prior to allocation\n       (all of the above: indan@nul.nu)\nv13: - rebase on to 88ebdda6159ffc15699f204c33feb3e431bf9bdc\nv12: - added a maximum instruction count per path (indan@nul.nu,oleg@redhat.com)\n     - removed copy_seccomp (keescook@chromium.org,indan@nul.nu)\n     - reworded the prctl_set_seccomp comment (indan@nul.nu)\nv11: - reorder struct seccomp_data to allow future args expansion (hpa@zytor.com)\n     - style clean up, @compat dropped, compat_sock_fprog32 (indan@nul.nu)\n     - do_exit(SIGSYS) (keescook@chromium.org, luto@mit.edu)\n     - pare down Kconfig doc reference.\n     - extra comment clean up\nv10: - seccomp_data has changed again to be more aesthetically pleasing\n       (hpa@zytor.com)\n     - calling convention is noted in a new u32 field using syscall_get_arch.\n       This allows for cross-calling convention tasks to use seccomp filters.\n       (hpa@zytor.com)\n     - lots of clean up (thanks, Indan!)\n v9: - n/a\n v8: - use bpf_chk_filter, bpf_run_filter. update load_fns\n     - Lots of fixes courtesy of indan@nul.nu:\n     -- fix up load behavior, compat fixups, and merge alloc code,\n     -- renamed pc and dropped __packed, use bool compat.\n     -- Added a hidden CONFIG_SECCOMP_FILTER to synthesize non-arch\n        dependencies\n v7:  (massive overhaul thanks to Indan, others)\n     - added CONFIG_HAVE_ARCH_SECCOMP_FILTER\n     - merged into seccomp.c\n     - minimal seccomp_filter.h\n     - no config option (part of seccomp)\n     - no new prctl\n     - doesn't break seccomp on systems without asm/syscall.h\n       (works but arg access always fails)\n     - dropped seccomp_init_task, extra free functions, ...\n     - dropped the no-asm/syscall.h code paths\n     - merges with network sk_run_filter and sk_chk_filter\n v6: - fix memory leak on attach compat check failure\n     - require no_new_privs || CAP_SYS_ADMIN prior to filter\n       installation. (luto@mit.edu)\n     - s/seccomp_struct_/seccomp_/ for macros/functions (amwang@redhat.com)\n     - cleaned up Kconfig (amwang@redhat.com)\n     - on block, note if the call was compat (so the # means something)\n v5: - uses syscall_get_arguments\n       (indan@nul.nu,oleg@redhat.com, mcgrathr@chromium.org)\n      - uses union-based arg storage with hi/lo struct to\n        handle endianness.  Compromises between the two alternate\n        proposals to minimize extra arg shuffling and account for\n        endianness assuming userspace uses offsetof().\n        (mcgrathr@chromium.org, indan@nul.nu)\n      - update Kconfig description\n      - add include/seccomp_filter.h and add its installation\n      - (naive) on-demand syscall argument loading\n      - drop seccomp_t (eparis@redhat.com)\n v4:  - adjusted prctl to make room for PR_[SG]ET_NO_NEW_PRIVS\n      - now uses current->no_new_privs\n        (luto@mit.edu,torvalds@linux-foundation.com)\n      - assign names to seccomp modes (rdunlap@xenotime.net)\n      - fix style issues (rdunlap@xenotime.net)\n      - reworded Kconfig entry (rdunlap@xenotime.net)\n v3:  - macros to inline (oleg@redhat.com)\n      - init_task behavior fixed (oleg@redhat.com)\n      - drop creator entry and extra NULL check (oleg@redhat.com)\n      - alloc returns -EINVAL on bad sizing (serge.hallyn@canonical.com)\n      - adds tentative use of \"always_unprivileged\" as per\n        torvalds@linux-foundation.org and luto@mit.edu\n v2:  - (patch 2 only)","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/a4878726c56ea743335e57fcd7460c48782143cc"},{"sha":"59d7ab947341f29b85b75fdbb00ac4afff43ad72","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"seccomp: remove duplicated failure logging\n\nThis consolidates the seccomp filter error logging path and adds more\ndetails to the audit log.\n\nSigned-off-by: Will Drewry <wad@chromium.org>\nSigned-off-by: Kees Cook <keescook@chromium.org>\nAcked-by: Eric Paris <eparis@redhat.com>\n\nv18: make compat= permanent in the record\nv15: added a return code to the audit_seccomp path by wad@chromium.org\n     (suggested by eparis@redhat.com)\nv*: original by keescook@chromium.org","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/59d7ab947341f29b85b75fdbb00ac4afff43ad72"},{"sha":"c11b2036b200978b3b3975128b8857734ab95175","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"seccomp: add SECCOMP_RET_ERRNO\n\nThis change adds the SECCOMP_RET_ERRNO as a valid return value from a\nseccomp filter.  Additionally, it makes the first use of the lower\n16-bits for storing a filter-supplied errno.  16-bits is more than\nenough for the errno-base.h calls.\n\nReturning errors instead of immediately terminating processes that\nviolate seccomp policy allow for broader use of this functionality\nfor kernel attack surface reduction.  For example, a linux container\ncould maintain a whitelist of pre-existing system calls but drop\nall new ones with errnos.  This would keep a logically static attack\nsurface while providing errnos that may allow for graceful failure\nwithout the downside of do_exit() on a bad call.\n\nThis change also changes the signature of __secure_computing.  It\nappears the only direct caller is the arm entry code and it clobbers\nany possible return value (register) immediately.\n\nSigned-off-by: Will Drewry <wad@chromium.org>\nAcked-by: Serge Hallyn <serge.hallyn@canonical.com>\nReviewed-by: Kees Cook <keescook@chromium.org>\nAcked-by: Eric Paris <eparis@redhat.com>\n\nv18: - fix up comments and rebase\n     - fix bad var name which was fixed in later revs\n     - remove _int() and just change the __secure_computing signature\nv16-v17: ...\nv15: - use audit_seccomp and add a skip label. (eparis@redhat.com)\n     - clean up and pad out return codes (indan@nul.nu)\nv14: - no change/rebase\nv13: - rebase on to 88ebdda6159ffc15699f204c33feb3e431bf9bdc\nv12: - move to WARN_ON if filter is NULL\n       (oleg@redhat.com, luto@mit.edu, keescook@chromium.org)\n     - return immediately for filter==NULL (keescook@chromium.org)\n     - change evaluation to only compare the ACTION so that layered\n       errnos don't result in the lowest one being returned.\n       (keeschook@chromium.org)\nv11: - check for NULL filter (keescook@chromium.org)\nv10: - change loaders to fn\n v9: - n/a\n v8: - update Kconfig to note new need for syscall_set_return_value.\n     - reordered such that TRAP behavior follows on later.\n     - made the for loop a little less indent-y\n v7: - introduced","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/c11b2036b200978b3b3975128b8857734ab95175"},{"sha":"d7a070d5849caec615a9857b13ee9c02d6158c2c","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"signal, x86: add SIGSYS info and make it synchronous.\n\nThis change enables SIGSYS, defines _sigfields._sigsys, and adds\nx86 (compat) arch support.  _sigsys defines fields which allow\na signal handler to receive the triggering system call number,\nthe relevant AUDIT_ARCH_* value for that number, and the address\nof the callsite.\n\nSIGSYS is added to the SYNCHRONOUS_MASK because it is desirable for it\nto have setup_frame() called for it. The goal is to ensure that\nucontext_t reflects the machine state from the time-of-syscall and not\nfrom another signal handler.\n\nThe first consumer of SIGSYS would be seccomp filter.  In particular,\na filter program could specify a new return value, SECCOMP_RET_TRAP,\nwhich would result in the system call being denied and the calling\nthread signaled.  This also means that implementing arch-specific\nsupport can be dependent upon HAVE_ARCH_SECCOMP_FILTER.\n\nSuggested-by: H. Peter Anvin <hpa@zytor.com>\nSigned-off-by: Will Drewry <wad@chromium.org>\nAcked-by: Serge Hallyn <serge.hallyn@canonical.com>\nReviewed-by: H. Peter Anvin <hpa@zytor.com>\nAcked-by: Eric Paris <eparis@redhat.com>\n\nv18: - added acked by, rebase\nv17: - rebase and reviewed-by addition\nv14: - rebase/nochanges\nv13: - rebase on to 88ebdda6159ffc15699f204c33feb3e431bf9bdc\nv12: - reworded changelog (oleg@redhat.com)\nv11: - fix dropped words in the change description\n     - added fallback copy_siginfo support.\n     - added __ARCH_SIGSYS define to allow stepped arch support.\nv10: - first version based on suggestion","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/d7a070d5849caec615a9857b13ee9c02d6158c2c"},{"sha":"0db2e2fbfd58ef62240eef20614ce79a5f0c8520","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"seccomp: Add SECCOMP_RET_TRAP\n\nAdds a new return value to seccomp filters that triggers a SIGSYS to be\ndelivered with the new SYS_SECCOMP si_code.\n\nThis allows in-process system call emulation, including just specifying\nan errno or cleanly dumping core, rather than just dying.\n\nSuggested-by: Markus Gutschke <markus@chromium.org>\nSuggested-by: Julien Tinnes <jln@chromium.org>\nSigned-off-by: Will Drewry <wad@chromium.org>\nAcked-by: Eric Paris <eparis@redhat.com>\n\nv18: - acked-by, rebase\n     - don't mention secure_computing_int() anymore\nv15: - use audit_seccomp/skip\n     - pad out error spacing; clean up switch (indan@nul.nu)\nv14: - n/a\nv13: - rebase on to 88ebdda6159ffc15699f204c33feb3e431bf9bdc\nv12: - rebase on to linux-next\nv11: - clarify the comment (indan@nul.nu)\n     - s/sigtrap/sigsys\nv10: - use SIGSYS, syscall_get_arch, updates arch/Kconfig\n       note suggested-by (though original suggestion had other behaviors)\nv9:  - changes to SIGILL\nv8:  - clean up based on changes to dependent patches\nv7:  - introduction","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/0db2e2fbfd58ef62240eef20614ce79a5f0c8520"},{"sha":"0030908cb70f36993e67fa3f4da435ef278d1d61","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"ptrace,seccomp: Add PTRACE_SECCOMP support\n\nThis change adds support for a new ptrace option, PTRACE_O_TRACESECCOMP,\nand a new return value for seccomp BPF programs, SECCOMP_RET_TRACE.\n\nWhen a tracer specifies the PTRACE_O_TRACESECCOMP ptrace option, the\ntracer will be notified, via PTRACE_EVENT_SECCOMP, for any syscall that\nresults in a BPF program returning SECCOMP_RET_TRACE.  The 16-bit\nSECCOMP_RET_DATA mask of the BPF program return value will be passed as\nthe ptrace_message and may be retrieved using PTRACE_GETEVENTMSG.\n\nIf the subordinate process is not using seccomp filter, then no\nsystem call notifications will occur even if the option is specified.\n\nIf there is no tracer with PTRACE_O_TRACESECCOMP when SECCOMP_RET_TRACE\nis returned, the system call will not be executed and an -ENOSYS errno\nwill be returned to userspace.\n\nThis change adds a dependency on the system call slow path.  Any future\nefforts to use the system call fast path for seccomp filter will need to\naddress this restriction.\n\nSigned-off-by: Will Drewry <wad@chromium.org>\nAcked-by: Eric Paris <eparis@redhat.com>\n\nv18: - rebase\n     - comment fatal_signal check\n     - acked-by\n     - drop secure_computing_int comment\nv17: - ...\nv16: - update PT_TRACE_MASK to 0xbf4 so that STOP isn't clear on SETOPTIONS call (indan@nul.nu)\n       [note PT_TRACE_MASK disappears in linux-next]\nv15: - add audit support for non-zero return codes\n     - clean up style (indan@nul.nu)\nv14: - rebase/nochanges\nv13: - rebase on to 88ebdda6159ffc15699f204c33feb3e431bf9bdc\n       (Brings back a change to ptrace.c and the masks.)\nv12: - rebase to linux-next\n     - use ptrace_event and update arch/Kconfig to mention slow-path dependency\n     - drop all tracehook changes and inclusion (oleg@redhat.com)\nv11: - invert the logic to just make it a PTRACE_SYSCALL accelerator\n       (indan@nul.nu)\nv10: - moved to PTRACE_O_SECCOMP / PT_TRACE_SECCOMP\nv9:  - n/a\nv8:  - guarded PTRACE_SECCOMP use with an ifdef\nv7:  - introduced","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/0030908cb70f36993e67fa3f4da435ef278d1d61"},{"sha":"d7215776e6473327ed2bf9d0bf3015864c16f3f0","author":{"email":"085326d3bff5b26df68da8c6a02454d5568d2311@google.com","name":"Sasha Levitskiy"},"message":"Change-Id: I7c9d49079d4e18390c2d520513a4afd55e6eaa3e","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/d7215776e6473327ed2bf9d0bf3015864c16f3f0"},{"sha":"feddf78f7a95c0b8c1ba56f545fcc161a5a8a9b2","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"Documentation: prctl/seccomp_filter\n\nDocuments how system call filtering using Berkeley Packet\nFilter programs works and how it may be used.\nIncludes an example for x86 and a semi-generic\nexample using a macro-based code generator.\n\nAcked-by: Eric Paris <eparis@redhat.com>\nSigned-off-by: Will Drewry <wad@chromium.org>\n\nv18: - added acked by\n     - update no new privs numbers\nv17: - remove @compat note and add Pitfalls section for arch checking\n       (keescook@chromium.org)\nv16: -\nv15: -\nv14: - rebase/nochanges\nv13: - rebase on to 88ebdda6159ffc15699f204c33feb3e431bf9bdc\nv12: - comment on the ptrace_event use\n     - update arch support comment\n     - note the behavior of SECCOMP_RET_DATA when there are multiple filters\n       (keescook@chromium.org)\n     - lots of samples/ clean up incl 64-bit bpf-direct support\n       (markus@chromium.org)\n     - rebase to linux-next\nv11: - overhaul return value language, updates (keescook@chromium.org)\n     - comment on do_exit(SIGSYS)\nv10: - update for SIGSYS\n     - update for new seccomp_data layout\n     - update for ptrace option use\nv9: - updated bpf-direct.c for SIGILL\nv8: - add PR_SET_NO_NEW_PRIVS to the samples.\nv7: - updated for all the new stuff in v7: TRAP, TRACE\n    - only talk about PR_SET_SECCOMP now\n    - fixed bad JLE32 check (coreyb@linux.vnet.ibm.com)\n    - adds dropper.c: a simple system call disabler\nv6: - tweak the language to note the requirement of\n      PR_SET_NO_NEW_PRIVS being called prior to use. (luto@mit.edu)\nv5: - update sample to use system call arguments\n    - adds a \"fancy\" example using a macro-based generator\n    - cleaned up bpf in the sample\n    - update docs to mention arguments\n    - fix prctl value (eparis@redhat.com)\n    - language cleanup (rdunlap@xenotime.net)\nv4: - update for no_new_privs use\n    - minor tweaks\nv3: - call out BPF <-> Berkeley Packet Filter (rdunlap@xenotime.net)\n    - document use of tentative always-unprivileged\n    - guard sample compilation for i386 and x86_64\nv2: - move code to samples (corbet@lwn.net)","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/feddf78f7a95c0b8c1ba56f545fcc161a5a8a9b2"},{"sha":"ed899b580f10af6962a41b68178aa12dad9194a0","author":{"email":"4bf0fb350827ce8d86875e76c923a478597c3cef@canb.auug.org.au","name":"Stephen Rothwell"},"message":"seccomp: use a static inline for a function stub\n\nFixes this error message when CONFIG_SECCOMP is not set:\n\narch/powerpc/kernel/ptrace.c: In function 'do_syscall_trace_enter':\narch/powerpc/kernel/ptrace.c:1713:2: error: statement with no effect [-Werror=unused-value]\n\nSigned-off-by: Stephen Rothwell <sfr@ozlabs.au.ibm.com>\nSigned-off-by: James Morris <james.l.morris@oracle.com>","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/ed899b580f10af6962a41b68178aa12dad9194a0"},{"sha":"a08761d86f33b20bc80000057d12d33f44b41bf1","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"seccomp: ignore secure_computing return values\n\nThis change is inspired by\n  https://lkml.org/lkml/2012/4/16/14\nwhich fixes the build warnings for arches that don't support\nCONFIG_HAVE_ARCH_SECCOMP_FILTER.\n\nIn particular, there is no requirement for the return value of\nsecure_computing() to be checked unless the architecture supports\nseccomp filter.  Instead of silencing the warnings with (void)\na new static inline is added to encode the expected behavior\nin a compiler and human friendly way.\n\nv2: - cleans things up with a static inline\n    - removes sfr's signed-off-by since it is a different approach\nv1: - matches sfr's original change\n\nReported-by: Stephen Rothwell <sfr@canb.auug.org.au>\nSigned-off-by: Will Drewry <wad@chromium.org>\nAcked-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: James Morris <james.l.morris@oracle.com>","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/a08761d86f33b20bc80000057d12d33f44b41bf1"},{"sha":"1386667be880a77d8e492c7252122412c312473f","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"seccomp: fix build warnings when there is no CONFIG_SECCOMP_FILTER\n\nIf both audit and seccomp filter support are disabled, 'ret' is marked\nas unused.\n\nIf just seccomp filter support is disabled, data and skip are considered\nunused.\n\nThis change fixes those build warnings.\n\nReported-by: Stephen Rothwell <sfr@canb.auug.org.au>\nSigned-off-by: Will Drewry <wad@chromium.org>\nAcked-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: James Morris <james.l.morris@oracle.com>","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/1386667be880a77d8e492c7252122412c312473f"},{"sha":"714d94e38e4f9d08e52281474007bbe5b543368a","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"samples/seccomp: fix dependencies on arch macros\n\nThis change fixes the compilation error reported for\ni386 allmodconfig here:\n  http://kisskb.ellerman.id.au/kisskb/buildresult/6123842/\n\nLogic attempting to predict the host architecture has been\nremoved from the Makefile.  Instead, the bpf-direct sample\nshould now compile on any architecture, but if the architecture\nis not supported, it will compile a minimal main() function.\n\nThis change also ensures the samples are not compiled when\nthere is no seccomp filter support.\n\nReported-by: Paul Gortmaker <paul.gortmaker@windriver.com>\nSuggested-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: Will Drewry <wad@chromium.org>","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/714d94e38e4f9d08e52281474007bbe5b543368a"},{"sha":"ebedcacb1b5025c59c70985bbcdee289a33a85d2","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"CHROMIUM: arch/arm: add asm/syscall.h\n\n(I will post this upstream after the 3.5 merge window)\n\nProvide an ARM implementation for asm-generic/syscall.h.\nThis is a pre-requisite for CONFIG_HAVE_ARCH_TRACEHOOK and\nCONFIG_HAVE_ARCH_SECCOMP_FILTER.  The latter is the forcing\nfunction for this patch.\n\nChange-Id: Idc5fa7b72691ec9d75418849733633df33482e53\nSigned-off-by: Will Drewry <wad@chromium.org>\n\nBUG=chromium-os:27878\nTEST=compiles for arm. Need to test on a live machine.\n\nChange-Id: I7b911b51085424aedd2beaf40683c3348b6cede1\nReviewed-on: https://gerrit.chromium.org/gerrit/21375\nReviewed-by: Will Drewry <wad@chromium.org>\nTested-by: Will Drewry <wad@chromium.org>\nSigned-off-by: Sasha Levitskiy <sanek@google.com>","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/ebedcacb1b5025c59c70985bbcdee289a33a85d2"},{"sha":"10a4b6f56fc62d70dab7d452a2fbf5234998bf35","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"CHROMIUM: arch/arm: move secure_computing into trace; respect return code\n\nThere is very little difference in the TIF_SECCOMP and TIF_SYSCALL_TRACE\npatsh in entry-common.S. In order to add support for\nCONFIG_HAVE_ARCH_SECCOMP_FILTER without mangling the assembly too\nbadly, seccomp was moved into the syscall_trace() handler.\n\nAdditionally, the return value for secure_computing() is now checked\nand a -1 value will result in the system call being skipped.\n\n(Reworked for 3.4 merge to just piggyback on the audit enter path.)\n\nSigned-off-by: Will Drewry <wad@chromium.org>\n\nBUG=chromium-os:27878\nTEST=compiles for arm. Need to test on a live machine.\n\nChange-Id: I9493f28c30356a10eccb320e0a2d1a141388af9a\nReviewed-on: https://gerrit.chromium.org/gerrit/21376\nReviewed-by: Will Drewry <wad@chromium.org>\nTested-by: Will Drewry <wad@chromium.org>\nSigned-off-by: Sasha Levitskiy <sanek@google.com>","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/10a4b6f56fc62d70dab7d452a2fbf5234998bf35"},{"sha":"4794f0a0754e3a19c7de816a56e94ddb99d6c33d","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"CHROMIUM: ARM: arch/arm: allow a scno of -1 to not cause a SIGILL\n\nOn tracehook-friendly platforms, a system call number of -1 falls\nthrough without running much code or taking much action.\n\nARM is different.  This adds a lightweight check to arm_syscall()\nto make sure that ARM behaves the same way.\n\nSigned-off-by: Will Drewry <wad@chromium.org>\nTEST=building on tegra2 now. Will live test with seccomp testsuite. It was through SIGILL.\nBUG=chromium-os:27878\n\nChange-Id: Ie3896b54e9bfa21c22e0df456a47ad03c8d0aa3f\nReviewed-on: https://gerrit.chromium.org/gerrit/21251\nReviewed-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Will Drewry <wad@chromium.org>\nTested-by: Will Drewry <wad@chromium.org>\nSigned-off-by: Sasha Levitskiy <sanek@google.com>","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/4794f0a0754e3a19c7de816a56e94ddb99d6c33d"},{"sha":"6185587e8f013ac652703dd91e2adebbfd359ca1","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"CHROMIUM: seccomp: set -ENOSYS if there is no tracer\n\n[Will attempt to add to -next, but this may need to wait\n until there is a motivating usecase, like ARM, since x86\n does the right thing already.]\n\nOn some arches, -ENOSYS is not set as the default system call\nreturn value.  This means that a skipped or invalid system call\ndoes not yield this response.  That behavior is not inline with\nthe stated ABI of seccomp filter.  To that end, we ensure we set\nthat value here to avoid arch idiosyncrasies.\n\nSigned-off-by: Will Drewry <wad@chromium.org>\nTEST=tegra2_kaen; boot, strace works, seccomp testsuite  trace tests pass\nBUG=chromium-os:27878\n\nChange-Id: I03a5e633d2fbb5d3d3cc33c067b2887068364c17\nReviewed-on: https://gerrit.chromium.org/gerrit/21337\nReviewed-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Will Drewry <wad@chromium.org>\nTested-by: Will Drewry <wad@chromium.org>\nSigned-off-by: Sasha Levitskiy <sanek@google.com>","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/6185587e8f013ac652703dd91e2adebbfd359ca1"},{"sha":"3f98c2176f4930aa155dc9ba7333dc5abcd333a9","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"CHROMIUM: ARM: r1->r0 for get/set arguments\n\nARM reuses r0 as the first argument. This fixes the mistaken\nassumption in the original patchset.  These will be merged\ninto one change when sent upstream.\n\nSigned-off-by: Will Drewry <wad@chromium.org>\nTEST=emerge tegra2_kaen; run seccomp testsuite\nBUG=chromium-os:27878\n\nChange-Id: Iaaa09995d35f78ee8cef7b600d526e71f3b2fcec\nReviewed-on: https://gerrit.chromium.org/gerrit/21342\nReviewed-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Will Drewry <wad@chromium.org>\nTested-by: Will Drewry <wad@chromium.org>\nSigned-off-by: Sasha Levitskiy <sanek@google.com>","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/3f98c2176f4930aa155dc9ba7333dc5abcd333a9"},{"sha":"ad1bca638f702708c05f14d28d38f6411a104cb2","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"MAINTAINERS: create seccomp entry\n\nAdd myself as seccomp maintainer.\n\nSuggested-by: James Morris <jmorris@namei.org>\nSigned-off-by: Kees Cook <keescook@chromium.org>","distinct":false,"url":"https://api.github.com/repos/0lvin/android_kernel_htc_z4u/commits/ad1bca638f702708c05f14d28d38f6411a104cb2"}]}