From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 00679433E93 for ; Sat, 4 Jul 2026 23:19:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783207148; cv=none; b=UZ8fbx1DzTkrzzGK+VJMzmOidSdnOiDPSPCb5ZWEDLOZ56KZUkPF342fcqbjEYfkfosyAeSwQtUjxO5BUZ2yjvjdcjbBy89gJkdTQy8sDuRMR5m+xmn/rY2lkfdHrWnLiiLsbIGmv9TNvEYm6Z2FKlbTe9MwPs/F0TwdGMMW9OQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783207148; c=relaxed/simple; bh=byIznTpu+V4tbBRQSV5wgb6TPhQkClsiMnCyCgJfX+Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=f7AWJ1dlpGZ8AQy41l28DQA5UH8ftXowjFK0zPcfNnm+AjORR40GFIC5+rMlj+YPwSaSmNGwxR7xyUUbw2uwWuzMB7e9DMSGfaJ3cvPjYJi97b+HaA1yEfiSmwKCdrQvWQiqrQAOtIsf1FbvnWO8jvwio6cNohHTS+hgUtDRnN4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PwhX5Z8r; arc=none smtp.client-ip=209.85.214.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PwhX5Z8r" Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2cc891373e0so75895ad.2 for ; Sat, 04 Jul 2026 16:19:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783207146; x=1783811946; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NLzPMJjcSzhlaojvcKAInoMhxtnZWtxftpw4XTb+woY=; b=PwhX5Z8r5cQQQbercnIppqe2TibMu1wrIUy35E4TbuJ6m4o+kh5LX+b12zOC0fUXcD 6r8CBa+/KZiPokiDAJXi1xTelkOcBGi+DI362Fh1gjyGK/YcDTni8Ks0ARU66NbL9ChP LAEe7tG9/L/SOjyzH76r+PF2+8OVw6tQ1TyWwrPSK5urW7fZVJc5vN/9vO5etCeduX8y FCmnsgvY4Z1BNk7HDfo0Qsv7Bic8A/ts7BFhbmVn5Lcz8N9fB4qWsk5ohXr+0yRVSoJM 3xCKN61YK3UeIBl2cdPulOM/dj6kLyA2PkJwSTkqMFcY6yqNBpfS5DGX9y5vCOOE+fl/ ONkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783207146; x=1783811946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=NLzPMJjcSzhlaojvcKAInoMhxtnZWtxftpw4XTb+woY=; b=R2LBEIrTWLS4OSmKNAPxEcHy14dsYgiT6XZVpZtQYcXLEBOh76HoED0/+1HYmv2YDt oh86XsrXSIWOj0IzTDyW8AX8Ds6z6aptacgiwggQjPBm4iOWriphOnja5lh7f5p9iP4M GqPn23YIrrE1O2q9PzLSLPDjWFgJrQmlHZ81JGrNzo3/u9E5WK9C1KASGJKW4RpCLnE+ 1mtNtaTiyPOOz6C/SqUJ3PJ6q5S6ve74pC0VZBZ3qh0AfX4ae6yPfzFaMNJH/fTmSzuk bVW1VsYItmPELWkmvtxMgdpqDWmOa1C7y10CHOD8gH9siW0pWE/4oJ+qQ9iyPfx/IFZB 0x4Q== X-Forwarded-Encrypted: i=1; AFNElJ8qErqlzLOxkah0L9aY9DeFEspKRbA0B5AnoIOOXC/rwVwX4yuyPh6dNRRsQrjnqeP8e3Kg8Dv4/qyMBPc=@vger.kernel.org X-Gm-Message-State: AOJu0YwQ0q5WwNBPenaRT/qp5dImjx6WnpVngbKwBFNlV/+9NvfX8U0R z/6D9DxQXUtvzMQO7crIbyOFZKGUJcBdcLSSe5Bnnqa22yYFSIAQ9Rgs X-Gm-Gg: AfdE7cknLYjzIX3rr596KFX/AvGJIH0DKqR6FLrLqUXrTVZSh8JqEPswuMUqtAX4Nmh GzZku0P/MD24SoT533qvE9yD4BjtXFV+yiu/AwWAtsuwJNftXT8kollTEGgV54eeyUgLshjmJvK jqBc4O/Ikw5jdrlqAwYkyM2rBleBdcPhDhZLH9OE26BAcIHsR1nt4jY3f8vZkQ/Q/wU71TBV+HK 06P4tLOaVazi5gvSw3EReFNz3qbnKj3dchRqhflglt05q7hfrUVzf79QdC0rwy5/OkjoPQZY3yE DBkrYIKS7FygX1aJ8fdLE99Hh1AjcO/1PZq1ZVpbT9UWrDqQ2ZHCp6ckMuXKrNiEqHrpYQ6gmfs PN6yLkt1pm5r5RxWTbpb2EUKRZz2tKbI9XTvCfjQAwOthOgiHty5eubhsFsmiuc4NNkGr7lPnK0 GS36bHX2iJQFSjHC+c/vQMbzU9kTZ5IFEq+hF9N4TlFK0uSsMX7Q== X-Received: by 2002:a17:903:3c4e:b0:2c7:ebfb:618f with SMTP id d9443c01a7336-2cbb77f3457mr47028285ad.14.1783207146354; Sat, 04 Jul 2026 16:19:06 -0700 (PDT) Received: from pop-os.. ([2601:647:6802:dbc0:55ba:96cc:892f:32d7]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cad776589fsm27088215ad.43.2026.07.04.16.19.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 04 Jul 2026 16:19:05 -0700 (PDT) From: Cong Wang To: Andy Lutomirski Cc: Kees Cook , linux-kernel@vger.kernel.org, Will Drewry , Christian Brauner , Andrew Morton , linux-mm@kvack.org, Cong Wang Subject: [PATCH v5 3/7] seccomp: add __NR_seccomp_* aliases for rt_sigreturn and clone/fork Date: Sat, 4 Jul 2026 16:18:27 -0700 Message-ID: <20260704231831.354543-4-xiyou.wangcong@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260704231831.354543-1-xiyou.wangcong@gmail.com> References: <20260704231831.354543-1-xiyou.wangcong@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Cong Wang The existing __NR_seccomp_* aliases name only the syscalls strict mode allows (read/write/exit/sigreturn). SEND_REDIRECT needs to recognise a few more so it can refuse to redirect them; add aliases for those, following the same arch-overridable pattern that keeps arch-specific numbers out of generic seccomp code: - __NR_seccomp_rt_sigreturn{,_32}: sigreturn and rt_sigreturn are distinct numbers on 32-bit/compat, so both must be nameable. The generic default aliases rt_sigreturn to the plain sigreturn number, a harmless duplicate on arches that do not distinguish the two. - __NR_seccomp_clone{,3}{,_32}, __NR_seccomp_{,v}fork{,_32}: the task-creation family. An arch lacking a syscall, or without a distinct compat number, maps it to -1, which is never a valid syscall number and so never matches. x86 supplies the ia32 compat numbers. No functional change; the aliases are consumed by the SEND_REDIRECT denylist in a later commit. Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Cong Wang --- arch/x86/include/asm/seccomp.h | 6 +++++ include/asm-generic/seccomp.h | 45 ++++++++++++++++++++++++++++++++++ 2 files changed, 51 insertions(+) diff --git a/arch/x86/include/asm/seccomp.h b/arch/x86/include/asm/seccomp.h index 42bcd42d70d1..c95c00b8927c 100644 --- a/arch/x86/include/asm/seccomp.h +++ b/arch/x86/include/asm/seccomp.h @@ -6,6 +6,7 @@ #ifdef CONFIG_X86_32 #define __NR_seccomp_sigreturn __NR_sigreturn +#define __NR_seccomp_rt_sigreturn __NR_rt_sigreturn #endif #ifdef CONFIG_COMPAT @@ -14,6 +15,11 @@ #define __NR_seccomp_write_32 __NR_ia32_write #define __NR_seccomp_exit_32 __NR_ia32_exit #define __NR_seccomp_sigreturn_32 __NR_ia32_sigreturn +#define __NR_seccomp_rt_sigreturn_32 __NR_ia32_rt_sigreturn +#define __NR_seccomp_clone_32 __NR_ia32_clone +#define __NR_seccomp_clone3_32 __NR_ia32_clone3 +#define __NR_seccomp_fork_32 __NR_ia32_fork +#define __NR_seccomp_vfork_32 __NR_ia32_vfork #endif #ifdef CONFIG_X86_64 diff --git a/include/asm-generic/seccomp.h b/include/asm-generic/seccomp.h index 6b6f42bc58f9..3c63ce888225 100644 --- a/include/asm-generic/seccomp.h +++ b/include/asm-generic/seccomp.h @@ -25,6 +25,51 @@ #ifndef __NR_seccomp_sigreturn #define __NR_seccomp_sigreturn __NR_rt_sigreturn #endif +#if defined(CONFIG_COMPAT) && !defined(__NR_seccomp_rt_sigreturn_32) +#define __NR_seccomp_rt_sigreturn_32 __NR_seccomp_sigreturn_32 +#endif +#ifndef __NR_seccomp_rt_sigreturn +#define __NR_seccomp_rt_sigreturn __NR_seccomp_sigreturn +#endif + +#ifndef __NR_seccomp_clone +#define __NR_seccomp_clone __NR_clone +#endif +#ifndef __NR_seccomp_clone3 +#ifdef __NR_clone3 +#define __NR_seccomp_clone3 __NR_clone3 +#else +#define __NR_seccomp_clone3 (-1) +#endif +#endif +#ifndef __NR_seccomp_fork +#ifdef __NR_fork +#define __NR_seccomp_fork __NR_fork +#else +#define __NR_seccomp_fork (-1) +#endif +#endif +#ifndef __NR_seccomp_vfork +#ifdef __NR_vfork +#define __NR_seccomp_vfork __NR_vfork +#else +#define __NR_seccomp_vfork (-1) +#endif +#endif +#ifdef CONFIG_COMPAT +#ifndef __NR_seccomp_clone_32 +#define __NR_seccomp_clone_32 (-1) +#endif +#ifndef __NR_seccomp_clone3_32 +#define __NR_seccomp_clone3_32 (-1) +#endif +#ifndef __NR_seccomp_fork_32 +#define __NR_seccomp_fork_32 (-1) +#endif +#ifndef __NR_seccomp_vfork_32 +#define __NR_seccomp_vfork_32 (-1) +#endif +#endif /* CONFIG_COMPAT */ #ifdef CONFIG_COMPAT #ifndef get_compat_mode1_syscalls -- 2.43.0