x86: Enable seccomp architecture tracking

Provide seccomp internals with the details to calculate which syscall
table the running kernel is expecting to deal with. This allows for
efficient architecture pinning and paves the way for constant-action
bitmaps.

Co-developed-by: YiFei Zhu <yifeifz2@illinois.edu>
Signed-off-by: YiFei Zhu <yifeifz2@illinois.edu>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/da58c3733d95c4f2115dd94225dfbe2573ba4d87.1602431034.git.yifeifz2@illinois.edu

diff --git a/arch/x86/include/asm/seccomp.h b/arch/x86/include/asm/seccomp.h
index 2bd1338..fef16e3 100644 (file)
--- a/arch/x86/include/asm/seccomp.h
+++ b/arch/x86/include/asm/seccomp.h
@@ -16,6 +16,26 @@
 #define __NR_seccomp_sigreturn_32      __NR_ia32_sigreturn
 #endif
 
+#ifdef CONFIG_X86_64
+# define SECCOMP_ARCH_NATIVE           AUDIT_ARCH_X86_64
+# define SECCOMP_ARCH_NATIVE_NR                NR_syscalls
+# define SECCOMP_ARCH_NATIVE_NAME      "x86_64"
+# ifdef CONFIG_COMPAT
+#  define SECCOMP_ARCH_COMPAT          AUDIT_ARCH_I386
+#  define SECCOMP_ARCH_COMPAT_NR       IA32_NR_syscalls
+#  define SECCOMP_ARCH_COMPAT_NAME     "ia32"
+# endif
+/*
+ * x32 will have __X32_SYSCALL_BIT set in syscall number. We don't support
+ * caching them and they are treated as out of range syscalls, which will
+ * always pass through the BPF filter.
+ */
+#else /* !CONFIG_X86_64 */
+# define SECCOMP_ARCH_NATIVE           AUDIT_ARCH_I386
+# define SECCOMP_ARCH_NATIVE_NR                NR_syscalls
+# define SECCOMP_ARCH_NATIVE_NAME      "ia32"
+#endif
+
 #include <asm-generic/seccomp.h>
 
 #endif /* _ASM_X86_SECCOMP_H */