From e1b0876fa9e70739844073af4d5a85de403c6e78 Mon Sep 17 00:00:00 2001 From: Bogdan Purcareata Date: Wed, 11 Mar 2015 08:52:32 +0000 Subject: lxc: Add support for seccomp on PPC architectures Add the necessary bits to enable seccomp support for LXC running on PPC architectures. libseccomp added support for PPC [1], yet to be applied to Yocto/meta-security. [1] https://github.com/seccomp/libseccomp/tree/working-ppc64 Signed-off-by: Bogdan Purcareata Signed-off-by: Bruce Ashfield --- .../files/ppc-add-seccomp-support-for-lxc.patch | 100 +++++++++++++++++++++ recipes-containers/lxc/lxc_1.0.7.bb | 1 + 2 files changed, 101 insertions(+) create mode 100644 recipes-containers/lxc/files/ppc-add-seccomp-support-for-lxc.patch diff --git a/recipes-containers/lxc/files/ppc-add-seccomp-support-for-lxc.patch b/recipes-containers/lxc/files/ppc-add-seccomp-support-for-lxc.patch new file mode 100644 index 00000000..6faf7917 --- /dev/null +++ b/recipes-containers/lxc/files/ppc-add-seccomp-support-for-lxc.patch @@ -0,0 +1,100 @@ +From 29ca2ec418cb496ac8a19f0718a8474a55cfe16d Mon Sep 17 00:00:00 2001 +From: Bogdan Purcareata +Date: Wed, 4 Feb 2015 11:28:32 +0000 +Subject: [PATCH] seccomp: add ppc support + +This patch enables seccomp support for LXC containers running on PowerPC +architectures. It is based on the latest PowerPC support added to libseccomp, on +the working-ppc64 branch [1]. + +Libseccomp has been tested on ppc, ppc64 and ppc64le architectures. LXC with +seccomp support has been tested on ppc and ppc64 architectures, using the +default seccomp policy example files delivered with the LXC package. + +[1] https://github.com/seccomp/libseccomp/commits/working-ppc64 + +Upstream-Status: Pending +[https://lists.linuxcontainers.org/pipermail/lxc-devel/2015-March/011437.html] + +Signed-off-by: Bogdan Purcareata +--- + src/lxc/seccomp.c | 42 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 42 insertions(+) + +diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c +index 3ba6c9a..0e2310f 100644 +--- a/src/lxc/seccomp.c ++++ b/src/lxc/seccomp.c +@@ -121,6 +121,9 @@ enum lxc_hostarch_t { + lxc_seccomp_arch_i386, + lxc_seccomp_arch_amd64, + lxc_seccomp_arch_arm, ++ lxc_seccomp_arch_ppc64, ++ lxc_seccomp_arch_ppc64le, ++ lxc_seccomp_arch_ppc, + lxc_seccomp_arch_unknown = 999, + }; + +@@ -137,6 +140,12 @@ int get_hostarch(void) + return lxc_seccomp_arch_amd64; + else if (strncmp(uts.machine, "armv7", 5) == 0) + return lxc_seccomp_arch_arm; ++ else if (strncmp(uts.machine, "ppc64le", 7) == 0) ++ return lxc_seccomp_arch_ppc64le; ++ else if (strncmp(uts.machine, "ppc64", 5) == 0) ++ return lxc_seccomp_arch_ppc64; ++ else if (strncmp(uts.machine, "ppc", 3) == 0) ++ return lxc_seccomp_arch_ppc; + return lxc_seccomp_arch_unknown; + } + +@@ -150,6 +159,9 @@ scmp_filter_ctx get_new_ctx(enum lxc_hostarch_t n_arch, uint32_t default_policy_ + case lxc_seccomp_arch_i386: arch = SCMP_ARCH_X86; break; + case lxc_seccomp_arch_amd64: arch = SCMP_ARCH_X86_64; break; + case lxc_seccomp_arch_arm: arch = SCMP_ARCH_ARM; break; ++ case lxc_seccomp_arch_ppc64le: arch = SCMP_ARCH_PPC64LE; break; ++ case lxc_seccomp_arch_ppc64: arch = SCMP_ARCH_PPC64; break; ++ case lxc_seccomp_arch_ppc: arch = SCMP_ARCH_PPC; break; + default: return NULL; + } + +@@ -343,6 +355,36 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf) + cur_rule_arch = lxc_seccomp_arch_arm; + } + #endif ++#ifdef SCMP_ARCH_PPC64LE ++ else if (strcmp(line, "[ppc64le]") == 0 || ++ strcmp(line, "[PPC64LE]") == 0) { ++ if (native_arch != lxc_seccomp_arch_ppc64le) { ++ cur_rule_arch = lxc_seccomp_arch_unknown; ++ continue; ++ } ++ cur_rule_arch = lxc_seccomp_arch_ppc64le; ++ } ++#endif ++#ifdef SCMP_ARCH_PPC64 ++ else if (strcmp(line, "[ppc64]") == 0 || ++ strcmp(line, "[PPC64]") == 0) { ++ if (native_arch != lxc_seccomp_arch_ppc64) { ++ cur_rule_arch = lxc_seccomp_arch_unknown; ++ continue; ++ } ++ cur_rule_arch = lxc_seccomp_arch_ppc64; ++ } ++#endif ++#ifdef SCMP_ARCH_PPC ++ else if (strcmp(line, "[ppc]") == 0 || ++ strcmp(line, "[PPC]") == 0) { ++ if (native_arch != lxc_seccomp_arch_ppc) { ++ cur_rule_arch = lxc_seccomp_arch_unknown; ++ continue; ++ } ++ cur_rule_arch = lxc_seccomp_arch_ppc; ++ } ++#endif + else + goto bad_arch; + +-- +2.1.4 + diff --git a/recipes-containers/lxc/lxc_1.0.7.bb b/recipes-containers/lxc/lxc_1.0.7.bb index b01c0063..c9eef754 100644 --- a/recipes-containers/lxc/lxc_1.0.7.bb +++ b/recipes-containers/lxc/lxc_1.0.7.bb @@ -29,6 +29,7 @@ SRC_URI = "http://linuxcontainers.org/downloads/${BPN}-${PV}.tar.gz \ file://add-lxc.rebootsignal.patch \ file://document-lxc.rebootsignal.patch \ file://lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch \ + file://ppc-add-seccomp-support-for-lxc.patch \ " SRC_URI[md5sum] = "b48f468a9bef0e4e140dd723f0a65ad0" -- cgit v1.2.3-54-g00ecf