From 8202d19608b25756957217ba11912e7bd507e99c Mon Sep 17 00:00:00 2001 From: ninez Date: Fri, 21 Oct 2016 17:29:15 -0400 Subject: [PATCH] msm8226_sec_defconfig: enable seccomp && seccomp_filter support CONFIG_SECCOMP=y CONFIG_SECCOMP_FILTER=y This commit finalizes and enables seccomp-bpf support for CyanogenMod/android_kernel_samsung_klte The prior 38 seccomp-bpf patches were cherry-picked from the CodeAurora/linux-msm-3.4 branch[1]. they were originally written for ChromiumOS's linux-3.4 seccomp-bpf support[2]. I have reworked the patchset to apply over CyanogenMod/android_kernel_samsung_klte to improve security, properly support sandboxing and support Android 7.0 'minijails'; a seccomp-bpf wrapper/library. - Tested with Chromium 56 - Tested with Chrome 54 - Tested with mediacodec - Tested with mediaextractor To check if a process has seccomp filters enabled; /proc//status seccomp: 0 = OFF seccomp: 2 = ON (seccomp filters are enabled) [1] https://source.codeaurora.org/quic/la/kernel/msm/log/?h=aosp-common/android-3.4 [2] https://www.chromium.org/chromium-os/developer-guide/chromium-os-sandboxing#h.l7ou90opzirq Signed-off-by: Kevin F. Haggerty --- arch/arm/configs/msm8226-sec_defconfig | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/configs/msm8226-sec_defconfig b/arch/arm/configs/msm8226-sec_defconfig index a5fc8fe331c..cf1ae8e06a3 100644 --- a/arch/arm/configs/msm8226-sec_defconfig +++ b/arch/arm/configs/msm8226-sec_defconfig @@ -11,6 +11,8 @@ CONFIG_CGROUP_CPUACCT=y CONFIG_RESOURCE_COUNTERS=y CONFIG_CGROUP_SCHED=y CONFIG_RT_GROUP_SCHED=y +CONFIG_SECCOMP=y +CONFIG_SECCOMP_FILTER=y CONFIG_NAMESPACES=y CONFIG_USER_RESET_DEBUG=y CONFIG_UTS_NS=y