SECCOMP for MIPS.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

2 files changed, 23 insertions, 4 deletions

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 41d782e207c3..b54ac9a75d5f 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1530,6 +1530,23 @@ config BINFMT_ELF32
         bool
         default y if MIPS32_O32 || MIPS32_N32
 
+config SECCOMP
+        bool "Enable seccomp to safely compute untrusted bytecode"
+        depends on PROC_FS && BROKEN
+        default y
+        help
+          This kernel feature is useful for number crunching applications
+          that may need to compute untrusted bytecode during their
+          execution. By using pipes or other transports made available to
+          the process as file descriptors supporting the read/write
+          syscalls, it's possible to isolate those applications in
+          their own address space using seccomp. Once seccomp is
+          enabled via /proc/<pid>/seccomp, it cannot be disabled
+          and the task is only allowed to execute a few safe syscalls
+          defined by each seccomp mode.
+
+          If unsure, say Y. Only embedded should say N here.
+
 config PM
         bool "Power Management support (EXPERIMENTAL)"
         depends on EXPERIMENTAL && MACH_AU1X00
diff --git a/include/asm-mips/thread_info.h b/include/asm-mips/thread_info.h
index a70cb0854c8a..66a0c2ae7d65 100644
--- a/include/asm-mips/thread_info.h
+++ b/include/asm-mips/thread_info.h
@@ -114,6 +114,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define TIF_SIGPENDING          2       /* signal pending */
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
 #define TIF_SYSCALL_AUDIT       4       /* syscall auditing active */
+#define TIF_SECCOMP             5       /* secure computing */
 #define TIF_USEDFPU             16      /* FPU was used by this task this quantum (SMP) */
 #define TIF_POLLING_NRFLAG      17      /* true if poll_idle() is polling TIF_NEED_RESCHED */
 #define TIF_MEMDIE              18
@@ -124,13 +125,14 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define _TIF_SIGPENDING         (1<<TIF_SIGPENDING)
 #define _TIF_NEED_RESCHED       (1<<TIF_NEED_RESCHED)
 #define _TIF_SYSCALL_AUDIT      (1<<TIF_SYSCALL_AUDIT)
+#define _TIF_SECCOMP            (1<<TIF_SECCOMP)
 #define _TIF_USEDFPU            (1<<TIF_USEDFPU)
 #define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
 
-#define _TIF_WORK_MASK          0x0000ffef      /* work to do on
-                                                   interrupt/exception return */
-#define _TIF_ALLWORK_MASK       0x8000ffff      /* work to do on any return to
-                                                   u-space */
+/* work to do on interrupt/exception return */
+#define _TIF_WORK_MASK          (0x0000ffef & ~_TIF_SECCOMP)
+/* work to do on any return to u-space */
+#define _TIF_ALLWORK_MASK       (0x8000ffff & ~_TIF_SECCOMP)
 
 #endif /* __KERNEL__ */