MIRRORS/meta-virtualization
1
0
Fork 0
mirror of git://git.yoctoproject.org/meta-virtualization.git synced 2025-07-19 12:50:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

lxc: Add support for seccomp on PPC architectures

Browse Source 
Add the necessary bits to enable seccomp support for LXC running on PPC
architectures. libseccomp added support for PPC [1], yet to be applied to
Yocto/meta-security.

[1] https://github.com/seccomp/libseccomp/tree/working-ppc64

Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
This commit is contained in:
Bogdan Purcareata 2015-03-11 08:52:32 +00:00 committed by Bruce Ashfield
parent d948b6a21d
commit e1b0876fa9
2 changed files with 101 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

100
recipes-containers/lxc/files/ppc-add-seccomp-support-for-lxc.patch Normal file
View File

@ -0,0 +1,100 @@
From 29ca2ec418cb496ac8a19f0718a8474a55cfe16d Mon Sep 17 00:00:00 2001
From: Bogdan Purcareata <bogdan.purcareata@freescale.com>
Date: Wed, 4 Feb 2015 11:28:32 +0000
Subject: [PATCH] seccomp: add ppc support
This patch enables seccomp support for LXC containers running on PowerPC
architectures. It is based on the latest PowerPC support added to libseccomp, on
the working-ppc64 branch [1].
Libseccomp has been tested on ppc, ppc64 and ppc64le architectures. LXC with
seccomp support has been tested on ppc and ppc64 architectures, using the
default seccomp policy example files delivered with the LXC package.
[1] https://github.com/seccomp/libseccomp/commits/working-ppc64
Upstream-Status: Pending
[https://lists.linuxcontainers.org/pipermail/lxc-devel/2015-March/011437.html]
Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
---
src/lxc/seccomp.c | 42 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)
diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c
index 3ba6c9a..0e2310f 100644
--- a/src/lxc/seccomp.c
+++ b/src/lxc/seccomp.c
@@ -121,6 +121,9 @@ enum lxc_hostarch_t {
lxc_seccomp_arch_i386,
lxc_seccomp_arch_amd64,
lxc_seccomp_arch_arm,
+ lxc_seccomp_arch_ppc64,
+ lxc_seccomp_arch_ppc64le,
+ lxc_seccomp_arch_ppc,
lxc_seccomp_arch_unknown = 999,
};
@@ -137,6 +140,12 @@ int get_hostarch(void)
return lxc_seccomp_arch_amd64;
else if (strncmp(uts.machine, "armv7", 5) == 0)
return lxc_seccomp_arch_arm;
+ else if (strncmp(uts.machine, "ppc64le", 7) == 0)
+ return lxc_seccomp_arch_ppc64le;
+ else if (strncmp(uts.machine, "ppc64", 5) == 0)
+ return lxc_seccomp_arch_ppc64;
+ else if (strncmp(uts.machine, "ppc", 3) == 0)
+ return lxc_seccomp_arch_ppc;
return lxc_seccomp_arch_unknown;
}
@@ -150,6 +159,9 @@ scmp_filter_ctx get_new_ctx(enum lxc_hostarch_t n_arch, uint32_t default_policy_
case lxc_seccomp_arch_i386: arch = SCMP_ARCH_X86; break;
case lxc_seccomp_arch_amd64: arch = SCMP_ARCH_X86_64; break;
case lxc_seccomp_arch_arm: arch = SCMP_ARCH_ARM; break;
+ case lxc_seccomp_arch_ppc64le: arch = SCMP_ARCH_PPC64LE; break;
+ case lxc_seccomp_arch_ppc64: arch = SCMP_ARCH_PPC64; break;
+ case lxc_seccomp_arch_ppc: arch = SCMP_ARCH_PPC; break;
default: return NULL;
}
@@ -343,6 +355,36 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
cur_rule_arch = lxc_seccomp_arch_arm;
}
#endif
+#ifdef SCMP_ARCH_PPC64LE
+ else if (strcmp(line, "[ppc64le]") == 0 ||
+ strcmp(line, "[PPC64LE]") == 0) {
+ if (native_arch != lxc_seccomp_arch_ppc64le) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+ cur_rule_arch = lxc_seccomp_arch_ppc64le;
+ }
+#endif
+#ifdef SCMP_ARCH_PPC64
+ else if (strcmp(line, "[ppc64]") == 0 ||
+ strcmp(line, "[PPC64]") == 0) {
+ if (native_arch != lxc_seccomp_arch_ppc64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+ cur_rule_arch = lxc_seccomp_arch_ppc64;
+ }
+#endif
+#ifdef SCMP_ARCH_PPC
+ else if (strcmp(line, "[ppc]") == 0 ||
+ strcmp(line, "[PPC]") == 0) {
+ if (native_arch != lxc_seccomp_arch_ppc) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+ cur_rule_arch = lxc_seccomp_arch_ppc;
+ }
+#endif
else
goto bad_arch;
--
2.1.4

1
recipes-containers/lxc/lxc_1.0.7.bb
View File

@ -29,6 +29,7 @@ SRC_URI = "http://linuxcontainers.org/downloads/${BPN}-${PV}.tar.gz \
file://add-lxc.rebootsignal.patch \
file://document-lxc.rebootsignal.patch \
file://lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch \
file://ppc-add-seccomp-support-for-lxc.patch \
"
SRC_URI[md5sum] = "b48f468a9bef0e4e140dd723f0a65ad0"