diff options
author | Bogdan Purcareata <bogdan.purcareata@freescale.com> | 2015-03-11 08:52:32 +0000 |
---|---|---|
committer | Bruce Ashfield <bruce.ashfield@windriver.com> | 2015-03-13 14:46:02 -0400 |
commit | e1b0876fa9e70739844073af4d5a85de403c6e78 (patch) | |
tree | 6434db998665d3e9f067bc85c22c458a3edad8a1 /recipes-containers | |
parent | d948b6a21ddec94dc55a9d650ca284ce10117da9 (diff) | |
download | meta-virtualization-e1b0876fa9e70739844073af4d5a85de403c6e78.tar.gz |
lxc: Add support for seccomp on PPC architectures
Add the necessary bits to enable seccomp support for LXC running on PPC
architectures. libseccomp added support for PPC [1], yet to be applied to
Yocto/meta-security.
[1] https://github.com/seccomp/libseccomp/tree/working-ppc64
Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Diffstat (limited to 'recipes-containers')
-rw-r--r-- | recipes-containers/lxc/files/ppc-add-seccomp-support-for-lxc.patch | 100 | ||||
-rw-r--r-- | recipes-containers/lxc/lxc_1.0.7.bb | 1 |
2 files changed, 101 insertions, 0 deletions
diff --git a/recipes-containers/lxc/files/ppc-add-seccomp-support-for-lxc.patch b/recipes-containers/lxc/files/ppc-add-seccomp-support-for-lxc.patch new file mode 100644 index 00000000..6faf7917 --- /dev/null +++ b/recipes-containers/lxc/files/ppc-add-seccomp-support-for-lxc.patch | |||
@@ -0,0 +1,100 @@ | |||
1 | From 29ca2ec418cb496ac8a19f0718a8474a55cfe16d Mon Sep 17 00:00:00 2001 | ||
2 | From: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
3 | Date: Wed, 4 Feb 2015 11:28:32 +0000 | ||
4 | Subject: [PATCH] seccomp: add ppc support | ||
5 | |||
6 | This patch enables seccomp support for LXC containers running on PowerPC | ||
7 | architectures. It is based on the latest PowerPC support added to libseccomp, on | ||
8 | the working-ppc64 branch [1]. | ||
9 | |||
10 | Libseccomp has been tested on ppc, ppc64 and ppc64le architectures. LXC with | ||
11 | seccomp support has been tested on ppc and ppc64 architectures, using the | ||
12 | default seccomp policy example files delivered with the LXC package. | ||
13 | |||
14 | [1] https://github.com/seccomp/libseccomp/commits/working-ppc64 | ||
15 | |||
16 | Upstream-Status: Pending | ||
17 | [https://lists.linuxcontainers.org/pipermail/lxc-devel/2015-March/011437.html] | ||
18 | |||
19 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
20 | --- | ||
21 | src/lxc/seccomp.c | 42 ++++++++++++++++++++++++++++++++++++++++++ | ||
22 | 1 file changed, 42 insertions(+) | ||
23 | |||
24 | diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c | ||
25 | index 3ba6c9a..0e2310f 100644 | ||
26 | --- a/src/lxc/seccomp.c | ||
27 | +++ b/src/lxc/seccomp.c | ||
28 | @@ -121,6 +121,9 @@ enum lxc_hostarch_t { | ||
29 | lxc_seccomp_arch_i386, | ||
30 | lxc_seccomp_arch_amd64, | ||
31 | lxc_seccomp_arch_arm, | ||
32 | + lxc_seccomp_arch_ppc64, | ||
33 | + lxc_seccomp_arch_ppc64le, | ||
34 | + lxc_seccomp_arch_ppc, | ||
35 | lxc_seccomp_arch_unknown = 999, | ||
36 | }; | ||
37 | |||
38 | @@ -137,6 +140,12 @@ int get_hostarch(void) | ||
39 | return lxc_seccomp_arch_amd64; | ||
40 | else if (strncmp(uts.machine, "armv7", 5) == 0) | ||
41 | return lxc_seccomp_arch_arm; | ||
42 | + else if (strncmp(uts.machine, "ppc64le", 7) == 0) | ||
43 | + return lxc_seccomp_arch_ppc64le; | ||
44 | + else if (strncmp(uts.machine, "ppc64", 5) == 0) | ||
45 | + return lxc_seccomp_arch_ppc64; | ||
46 | + else if (strncmp(uts.machine, "ppc", 3) == 0) | ||
47 | + return lxc_seccomp_arch_ppc; | ||
48 | return lxc_seccomp_arch_unknown; | ||
49 | } | ||
50 | |||
51 | @@ -150,6 +159,9 @@ scmp_filter_ctx get_new_ctx(enum lxc_hostarch_t n_arch, uint32_t default_policy_ | ||
52 | case lxc_seccomp_arch_i386: arch = SCMP_ARCH_X86; break; | ||
53 | case lxc_seccomp_arch_amd64: arch = SCMP_ARCH_X86_64; break; | ||
54 | case lxc_seccomp_arch_arm: arch = SCMP_ARCH_ARM; break; | ||
55 | + case lxc_seccomp_arch_ppc64le: arch = SCMP_ARCH_PPC64LE; break; | ||
56 | + case lxc_seccomp_arch_ppc64: arch = SCMP_ARCH_PPC64; break; | ||
57 | + case lxc_seccomp_arch_ppc: arch = SCMP_ARCH_PPC; break; | ||
58 | default: return NULL; | ||
59 | } | ||
60 | |||
61 | @@ -343,6 +355,36 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf) | ||
62 | cur_rule_arch = lxc_seccomp_arch_arm; | ||
63 | } | ||
64 | #endif | ||
65 | +#ifdef SCMP_ARCH_PPC64LE | ||
66 | + else if (strcmp(line, "[ppc64le]") == 0 || | ||
67 | + strcmp(line, "[PPC64LE]") == 0) { | ||
68 | + if (native_arch != lxc_seccomp_arch_ppc64le) { | ||
69 | + cur_rule_arch = lxc_seccomp_arch_unknown; | ||
70 | + continue; | ||
71 | + } | ||
72 | + cur_rule_arch = lxc_seccomp_arch_ppc64le; | ||
73 | + } | ||
74 | +#endif | ||
75 | +#ifdef SCMP_ARCH_PPC64 | ||
76 | + else if (strcmp(line, "[ppc64]") == 0 || | ||
77 | + strcmp(line, "[PPC64]") == 0) { | ||
78 | + if (native_arch != lxc_seccomp_arch_ppc64) { | ||
79 | + cur_rule_arch = lxc_seccomp_arch_unknown; | ||
80 | + continue; | ||
81 | + } | ||
82 | + cur_rule_arch = lxc_seccomp_arch_ppc64; | ||
83 | + } | ||
84 | +#endif | ||
85 | +#ifdef SCMP_ARCH_PPC | ||
86 | + else if (strcmp(line, "[ppc]") == 0 || | ||
87 | + strcmp(line, "[PPC]") == 0) { | ||
88 | + if (native_arch != lxc_seccomp_arch_ppc) { | ||
89 | + cur_rule_arch = lxc_seccomp_arch_unknown; | ||
90 | + continue; | ||
91 | + } | ||
92 | + cur_rule_arch = lxc_seccomp_arch_ppc; | ||
93 | + } | ||
94 | +#endif | ||
95 | else | ||
96 | goto bad_arch; | ||
97 | |||
98 | -- | ||
99 | 2.1.4 | ||
100 | |||
diff --git a/recipes-containers/lxc/lxc_1.0.7.bb b/recipes-containers/lxc/lxc_1.0.7.bb index b01c0063..c9eef754 100644 --- a/recipes-containers/lxc/lxc_1.0.7.bb +++ b/recipes-containers/lxc/lxc_1.0.7.bb | |||
@@ -29,6 +29,7 @@ SRC_URI = "http://linuxcontainers.org/downloads/${BPN}-${PV}.tar.gz \ | |||
29 | file://add-lxc.rebootsignal.patch \ | 29 | file://add-lxc.rebootsignal.patch \ |
30 | file://document-lxc.rebootsignal.patch \ | 30 | file://document-lxc.rebootsignal.patch \ |
31 | file://lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch \ | 31 | file://lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch \ |
32 | file://ppc-add-seccomp-support-for-lxc.patch \ | ||
32 | " | 33 | " |
33 | 34 | ||
34 | SRC_URI[md5sum] = "b48f468a9bef0e4e140dd723f0a65ad0" | 35 | SRC_URI[md5sum] = "b48f468a9bef0e4e140dd723f0a65ad0" |