From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: [RFC PATCH] linux: Enable seccomp filter on ARM Date: Mon, 19 Sep 2022 12:35:41 +0000 Message-ID: <52660e04-d262-68ab-c42a-429821688153@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5889534172711761465==" List-Id: --===============5889534172711761465== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Since last time we checked, the kernel's security features on ARM have improved notably (see CONFIG_RANDOMIZE_BASE discussion). This patch therefore proposes to give the seccomp filter on both 32- and 64-bit ARM another try, since it provides significant security benefit to applications using it. Due to operational constraints, rootfile changes have been omitted, and will be conducted, should this patch be approved. Note to future self: Once this patch is approved, applications using seccomp (OpenSSH, Tor) need to be updated/shipped on ARM. Fixes: #12366 Fixes: #12370 Cc: Arne Fitzenreiter Signed-off-by: Peter M=C3=BCller --- config/kernel/kernel.config.aarch64-ipfire | 4 +++- config/kernel/kernel.config.armv6l-ipfire | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kerne= l.config.aarch64-ipfire index b557f4cf3..62ef1316a 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -683,7 +683,9 @@ CONFIG_HAVE_CMPXCHG_DOUBLE=3Dy CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=3Dy CONFIG_HAVE_ARCH_SECCOMP=3Dy CONFIG_HAVE_ARCH_SECCOMP_FILTER=3Dy -# CONFIG_SECCOMP is not set +CONFIG_SECCOMP=3Dy +CONFIG_SECCOMP_FILTER=3Dy +# CONFIG_SECCOMP_CACHE_DEBUG is not set CONFIG_HAVE_ARCH_STACKLEAK=3Dy CONFIG_HAVE_STACKPROTECTOR=3Dy CONFIG_STACKPROTECTOR=3Dy diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel= .config.armv6l-ipfire index b8e0ee70c..47baada15 100644 --- a/config/kernel/kernel.config.armv6l-ipfire +++ b/config/kernel/kernel.config.armv6l-ipfire @@ -767,7 +767,9 @@ CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=3Dy CONFIG_ARCH_WANT_IPC_PARSE_VERSION=3Dy CONFIG_HAVE_ARCH_SECCOMP=3Dy CONFIG_HAVE_ARCH_SECCOMP_FILTER=3Dy -# CONFIG_SECCOMP is not set +CONFIG_SECCOMP=3Dy +CONFIG_SECCOMP_FILTER=3Dy +# CONFIG_SECCOMP_CACHE_DEBUG is not set CONFIG_HAVE_STACKPROTECTOR=3Dy CONFIG_STACKPROTECTOR=3Dy CONFIG_STACKPROTECTOR_STRONG=3Dy --=20 2.35.3 --===============5889534172711761465==--