Commit Graph

6 Commits

Author SHA1 Message Date
Paul Lawrence e4ddaa4f2f Allow failing app through seccomp policy
Bug: 34651972
Test: Made sure failing app went to login screen
Change-Id: I111a379f3e8283aa829d9ceb97f95b34bbee4055
2017-01-27 18:32:11 +00:00
Paul Lawrence 73f6e44c8b Allow __NR_perf_event_open
Bug: 34732712
Test: strace simpleperf32 record -g runs
Change-Id: Id2ffd1e808587bf809a7ff0303163816a0e8fbce
2017-01-27 08:25:56 -08:00
Paul Lawrence 31b2a9d7a3 Allow __NR_pipe for 32-bit processes
Used by 32-bit debuggers

Bug: 34716063
Test: Make sure a Chrome crash produces a valid stack trace in logcat
Change-Id: Ie42f035da7f19ace403eb2111524f02c0bbfd0d5
2017-01-26 12:31:55 -08:00
Colin Cross 2e253cbcc6 Allow tkill
tkill and tgkill are syscalls that do not have glibc wrappers, but
they are required in order to send a signal to a specific thread.
Non-android software may call them directly with syscall().  Bionic
provides a wrapper for tgkill, so seccomp allows it, but not for
tkill.  Add tkill to the whitelist.

This can be reproduced with:
sleep 1000 & sleep 1 ; strace -p $!
then hit ctrl-C, and the shell will print "Bad system call" because
the strace process died with SIGSYS

Bug: 34586922
Test: repro case is fixed
Change-Id: Ib6962a967f2cc757f2906de7905e75e1b6d6f39f
2017-01-23 17:10:51 -08:00
Colin Cross 47afc6b64e Allow restart_syscall
restart_syscall is used by the kernel whenever a syscall with a
timeout is interrupted.  Whitelist it in seccomp to prevent
processes being killed with SIGSYS when being ptraced.

Bug: 34586922
Test: hwui_unit_tests
Change-Id: Ic47dcad33f3082eb5673c3c67fe17200d4daaf74
2017-01-23 17:05:01 -08:00
Paul Lawrence db929bf9b7 Enable seccomp in init with generated policy
Test: Ran script to test performance - https://b.corp.google.com/issues/32313202#comment3
      Saw no significant regression with this change on or off
      Removed chroot from SYSCALLS.TXT - chroot blocked
      Boot time appears reasonable
      Device boots with no SECCOMP blockings
      Measured per syscall time of 100ns
      Empirically counted <100,000 syscalls a second under heavy load

Bug: 32313202
Change-Id: Icfcfbcb72b2de1b38f1ad6a82e8ece3bd1c9e7ec
2017-01-10 10:09:38 -08:00