Commit Graph

8 Commits

Author SHA1 Message Date
Treehugger Robot c66cb5ba6a Merge "add new Linux close_range() system call to bionic" 2022-05-06 22:25:26 +00:00
Maciej Żenczykowski b65e105047 add new Linux close_range() system call to bionic
See:
  https://man7.org/linux/man-pages/man2/close_range.2.html

Note: 'man close_range' documents 'flags' as unsigned int,
while glibc unistd.h as just 'int'.  Picking 'int' to match glibc,
though it probably doesn't matter.

BYPASS_INCLUSIVE_LANGUAGE_REASON=man is a cli command
Test: TreeHugger
Bug: 229913920
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1e2d1c8edc2ea28922d60f3ce3e534a784622cd1
2022-05-06 10:33:04 +00:00
Elliott Hughes 082b9290d0 Merge "seccomp: allow stat() for ubsan." 2022-05-04 16:35:26 +00:00
Elliott Hughes a0745cea5f seccomp: allow stat() for ubsan.
We've had complaints about ubsan issues for years, but never got to the
bottom of them, or saw them ourselves in testing. For some reason (still
not understood) we've started to see this ourselves in T and downstream
branches. So for now, let's just punch that extra hole.

Longer term, ubsan should stop needing any of this, so once
https://reviews.llvm.org/D124212 is in an LTS NDK, we should be able to
get rid of this _and_ the existing sanitizer-related holes.

Bug: https://github.com/android/ndk/issues/1298
Bug: http://b/229989971
Test: treehugger
Change-Id: Id42cb29c4e943c0080c0d34ce4e5d6d1b32da9e8
2022-04-29 15:48:08 -07:00
Maciej Żenczykowski c9c0ebde3c allowlist new Linux close_range() system call, use it in posix_spawn()
Linux kernel's close_range() system call (currently) allows:
  close() unshare() fcntl(F_SETFD, FD_CLOEXEC)
to be performed on ranges of fds.

All 3 of these are already allowed by seccomp bpf:
as such this doesn't allow you to do anything you can't already do.

We can't add close_range() properly to bionic because we'd need to
fiddle about with ltp and it's too late to add new T API anyway,
so let's just make the direct syscall() call.

We'll add proper support in U.

See also:
  https://man7.org/linux/man-pages/man2/close_range.2.html

Test: TreeHugger
Bug: 229913920
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I85586d544fc23bed6aee59f00bdb79ee7a8150d1
2022-04-28 23:33:38 +00:00
Lokesh Gidra 7839c173f1 Add userfaultfd syscall in SECCOMP allowlist
Enable userfaultfd syscall to be used by ART-GC.

Bug: 160737021
Test: manually tested by invoking userfaultfd syscall in ART
Change-Id: I9f98402a96bb8363a1e5fa49dbadbb37dc70d561
2021-03-11 19:30:08 +00:00
Josh Gao 3de19151e5 Add wrappers for pidfd_{open,getfd,send_signal}.
Bug: http://b/172518739
Test: `/data/nativetest64/bionic-unit-tests/bionic-unit-tests --gtest_filter="*pidfd*"` on blueline
Change-Id: Ibae32bbedbcf26535a80a5cbfb55ce180906b610
2021-02-25 13:55:12 -08:00
Victor Hsieh dbb8670dfd Use more inclusive language for seccomp filter
blacklist and whitelist are replaced with blocklist and allowlist
respectively.

Test: CtsSeccompHostTestCases
Change-Id: I39d9eda89038d1addbdaed59284a254a34cea1c6
2020-06-15 10:12:17 -07:00