On Thu, Jul 23, 2015 at 4:36 PM, Kees Cook <keesc...@chromium.org> wrote:
> On Thu, Jul 23, 2015 at 3:24 AM, Willy Tarreau <w...@1wt.eu> wrote:
>> #ifdef CONFIG_SMP
>> static void flush_ldt(void *current_mm)
>> {
>> @@ -254,6 +260,9 @@ asmlinkage int sys_modify_ldt(int func, void __user *ptr,
>> {
>> int ret = -ENOSYS;
>>
>> + if (!sysctl_modify_ldt)
>> + return ret;
>> +
>> switch (func) {
>> case 0:
>> ret = read_ldt(ptr, bytecount);
>> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
>> index 2082b1a..60270c6 100644
>> --- a/kernel/sysctl.c
>> +++ b/kernel/sysctl.c
>> @@ -111,6 +111,9 @@ extern int sysctl_nr_open_min, sysctl_nr_open_max;
>> #ifndef CONFIG_MMU
>> extern int sysctl_nr_trim_pages;
>> #endif
>> +#ifdef CONFIG_X86
>> +extern int sysctl_modify_ldt;
>> +#endif
>>
>> /* Constants used for minimum and maximum */
>> #ifdef CONFIG_LOCKUP_DETECTOR
>> @@ -962,6 +965,13 @@ static struct ctl_table kern_table[] = {
>> .mode = 0644,
>> .proc_handler = proc_dointvec,
>> },
>> + {
>> + .procname = "modify_ldt",
>> + .data = &sysctl_modify_ldt,
>> + .maxlen = sizeof(int),
>> + .mode = 0644,
>> + .proc_handler = proc_dointvec,
>> + },
>> #endif
>> #if defined(CONFIG_MMU)
>> {
>
> I've been pondering something like this that is even MORE generic, for
> any syscall. Something like a "syscalls" directory under
> /proc/sys/kernel, with 1 entry per syscall. "0" is "available", "1" is
> disabled, and "-1" disabled until next boot.
>
It might want to be /proc/sys/kernel/syscalls/[abi]/[name], possibly
with more than just those options. We might want "disabled, returns
ENOSYS", "disabled, returns EPERM", and a lock bit.
On x86 at least, the implementation's easy -- we can just poke the
syscall table.
--Andy
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
