Re: [PATCH 1/2] entry: Fix CONFIG_SECCOMP assumption

[Thomas Gleixner]

Ingo Molnar <mingo@xxxxxxxxxx> writes:
> The __secure_computing() callback only exists on CONFIG_SECCOMP=y,

No. There is a stub function for the SECCOMP=n case.

> and on architectures that have CONFIG_HAVE_ARCH_SECCOMP_FILTER.

which is a prerequiste for converting over.

> Instead of complicating the #ifdef within the generic entry code,

There is no #ifdef in the generic code and there is none required.

> make the generic entry code depend on the availability of a modern
> seccomp framework. This was implicit in the generic code due to
> x86 being a modern seccomp-filter architecture.
>
> Also move the Kconfig entry to after its HAVE_ARCH_SECCOMP_FILTER
> dependency and fix minor whitespace damage while at it.
>
> Fixes: 142781e108b1: ("entry: Provide generic syscall entry
> functionality")

I don't see what that fixes.

> Signed-off-by: Ingo Molnar <mingo@xxxxxxxxxx>
> ---
>  arch/Kconfig          | 6 ++++--
>  kernel/entry/common.c | 2 ++
>  2 files changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/arch/Kconfig b/arch/Kconfig
> index 852a527f418f..c2b29cfc4796 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -27,8 +27,6 @@ config HAVE_IMA_KEXEC
>  config HOTPLUG_SMT
>  	bool
>  
> -config GENERIC_ENTRY
> -       bool
>  
>  config OPROFILE
>  	tristate "OProfile system profiling"
> @@ -654,6 +652,10 @@ config HAVE_IRQ_EXIT_ON_IRQ_STACK
>  	  This spares a stack switch and improves cache usage on softirq
>  	  processing.
>  
> +config GENERIC_ENTRY
> +	bool
> +	depends on HAVE_ARCH_SECCOMP_FILTER

Any architecture which wants to switch over to this should have
that. Otherwise the build will just fail and rightfully so.

>  
> +#ifdef CONFIG_SECCOMP

And the exact point of that ifdef is? This code was carefully written
NOT to have ifdefs and all non-active things are optimized out by the
compiler.


>  	/* Do seccomp after ptrace, to catch any tracer changes. */
>  	if (ti_work & _TIF_SECCOMP) {
>  		ret = __secure_computing(NULL);
>  		if (ret == -1L)
>  			return ret;
>  	}
> +#endif

Thanks,

        tglx