diff mbox series

[pseudo,5/6] ports/linux/pseudo_wrappers: Fake seccomp filters set by prctl()

Message ID 1794500398-31706-6-git-send-email-mark.hatle@kernel.crashing.org
State New
Headers show
Series Add landlock support, fix seccomp | expand

Commit Message

Mark Hatle Nov. 12, 2026, 4:19 p.m. UTC 
From: Mark Hatle <mark.hatle@amd.com>

prctl(PR_SET_SECCOMP) was compared against SECCOMP_SET_MODE_FILTER,
which is the seccomp() system call's value.  prctl() takes
SECCOMP_MODE_*, where that value means strict mode, so prctl() filters
were really installed and strict mode was faked by accident.  Fake both
SECCOMP_MODE_FILTER and SECCOMP_MODE_STRICT.

AI-Generated: Uses GitHub Copilot
Signed-off-by: Mark Hatle <mark.hatle@amd.com>
---
 ports/linux/pseudo_wrappers.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/ports/linux/pseudo_wrappers.c b/ports/linux/pseudo_wrappers.c
index 7d1e7d9..e3cf18b 100644
--- a/ports/linux/pseudo_wrappers.c
+++ b/ports/linux/pseudo_wrappers.c
@@ -240,15 +240,18 @@  prctl(int option, ...) {
 		return rc;
 	}
 
-#ifdef SECCOMP_SET_MODE_FILTER
+#ifdef PR_SET_SECCOMP
 	/* pseudo and seccomp are incompatible as pseudo uses different syscalls
-	 * so pretend to enable seccomp but really do nothing */
+	 * so pretend to enable seccomp but really do nothing.  prctl() takes
+	 * SECCOMP_MODE_*, not the SECCOMP_SET_MODE_* values seccomp() takes.
+	 */
 	if (option == PR_SET_SECCOMP) {
 		unsigned long cmd;
 		va_start(ap, option);
 		cmd = va_arg(ap, unsigned long);
 		va_end(ap);
-		if (cmd == SECCOMP_SET_MODE_FILTER) {
+		if (cmd == SECCOMP_MODE_STRICT || cmd == SECCOMP_MODE_FILTER) {
+		    pseudo_debug(PDBGF_SYSCALL, "prctl, faking seccomp.\n");
 		    return 0;
 		}
 	}