| *
900e9fd 2014-10-08 leecam@chromium.org seccomp: fix syscall numbers for x86 and x86_64
| *
9ac8600 2014-08-10 linux@roeck-us.net seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock
| *
f14a5db 2014-06-05 keescook@chromium.org seccomp: implement SECCOMP_FILTER_FLAG_TSYNC
| *
c852ef7 2014-06-27 keescook@chromium.org seccomp: allow mode setting across threads
| *
61b6b88 2014-06-27 keescook@chromium.org seccomp: introduce writer locking
| *
b6a12bf 2014-06-27 keescook@chromium.org seccomp: split filter prep from check and apply
| *
9d0ff69 2014-05-21 keescook@chromium.org sched: move no_new_privs into new atomic flags
| *
e985fd4 2014-06-25 keescook@chromium.org seccomp: add "seccomp" syscall
| *
8908dde 2014-06-25 keescook@chromium.org seccomp: split mode setting routines
| *
b8a9cff 2014-06-25 keescook@chromium.org seccomp: extract check/assign mode helpers
| *
2a30a43 2014-05-21 keescook@chromium.org seccomp: create internal mode-setting function
| *
987a0f1 2014-01-21 oleg@redhat.com introduce for_each_thread() to replace the buggy while_each_thread()
| *
a03a242 2013-11-06 peterz@infradead.org arch: Introduce smp_load_acquire(), smp_store_release()
| *
210957c 2014-09-04 takahiro.akashi@linaro.org arm64: add seccomp support
| *
9499cd2 2014-03-11 eparis@redhat.com syscall_get_arch: remove useless function arguments
| *
7722723 2014-09-04 takahiro.akashi@linaro.org arm64: add SIGSYS siginfo for compat task
| *
4f12b53 2014-09-04 takahiro.akashi@linaro.org add seccomp syscall for compat task
| *
dab1073 2014-09-04 takahiro.akashi@linaro.org asm-generic: add generic seccomp.h for secure computing mode 1
| *
feb2843 2014-09-04 takahiro.akashi@linaro.org arm64: ptrace: allow tracer to skip a system call
| *
abbfed9 2014-09-04 takahiro.akashi@linaro.org arm64: ptrace: add PTRACE_SET_SYSCALL
Conflicts:
arch/arm64/Kconfig
Signed-off-by: Lee Campbell <leecam@chromium.org>
select GENERIC_TIME_VSYSCALL
select HARDIRQS_SW_RESEND
select HAVE_ARCH_AUDITSYSCALL
+ select HAVE_ARCH_KGDB
+ select HAVE_ARCH_JUMP_LABEL
+ select HAVE_ARCH_SECCOMP_FILTER
select HAVE_ARCH_TRACEHOOK
select HAVE_DEBUG_BUGVERBOSE
select HAVE_DEBUG_KMEMLEAK
source "mm/Kconfig"
+ config SECCOMP
+ bool "Enable seccomp to safely compute untrusted bytecode"
+ ---help---
+ This kernel feature is useful for number crunching applications
+ that may need to compute untrusted bytecode during their
+ execution. By using pipes or other transports made available to
+ the process as file descriptors supporting the read/write
+ syscalls, it's possible to isolate those applications in
+ their own address space using seccomp. Once seccomp is
+ enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
+ and the task is only allowed to execute a few safe syscalls
+ defined by each seccomp mode.
+
+config FORCE_MAX_ZONEORDER
+ int
+ default "14" if (ARM64_64K_PAGES && TRANSPARENT_HUGEPAGE)
+ default "11"
endmenu