Add support for SECCOMP_FILTER_FLAG_TSYNC.
This allows synchronizing all threads in a thread group to the same
seccomp filter tree.
Some processes only receive control over their execution after
threads have already been created in their thread group. This happens
for example with apps forked from the Android zygote.
Thread sync (TSYNC) allows these processes to safely apply seccomp
filters to all threads in their thread group, therefore preventing
a thread running with seccomp filters from being able to circumvent
the filter by exploiting an unconfined thread in the same thread
group.
Bug: 31267783
Test: Manual, with multithreaded program calling libminijail.
Change-Id: I902428abf2e4d7fb3e2200ebfe9d5e640a1b10e0
diff --git a/Makefile b/Makefile
index 25e6494..4cbf0b6 100644
--- a/Makefile
+++ b/Makefile
@@ -24,24 +24,25 @@
CC_BINARY(minijail0): LDLIBS += -lcap -ldl
CC_BINARY(minijail0): libconstants.gen.o libsyscalls.gen.o libminijail.o \
- syscall_filter.o signal_handler.o bpf.o util.o elfparse.o minijail0.o
+ syscall_filter.o signal_handler.o bpf.o util.o elfparse.o \
+ syscall_wrapper.o minijail0.o
clean: CLEAN(minijail0)
CC_LIBRARY(libminijail.so): LDLIBS += -lcap
CC_LIBRARY(libminijail.so): libminijail.o syscall_filter.o signal_handler.o \
- bpf.o util.o libconstants.gen.o libsyscalls.gen.o
+ bpf.o util.o syscall_wrapper.o libconstants.gen.o libsyscalls.gen.o
clean: CLEAN(libminijail.so)
CC_BINARY(libminijail_unittest): LDLIBS += -lcap
CC_BINARY(libminijail_unittest): libminijail_unittest.o libminijail.o \
- syscall_filter.o signal_handler.o bpf.o util.o libconstants.gen.o \
- libsyscalls.gen.o
+ syscall_filter.o signal_handler.o bpf.o util.o syscall_wrapper.o \
+ libconstants.gen.o libsyscalls.gen.o
clean: CLEAN(libminijail_unittest)
CC_LIBRARY(libminijailpreload.so): LDLIBS += -lcap -ldl
CC_LIBRARY(libminijailpreload.so): libminijailpreload.o libminijail.o \
libconstants.gen.o libsyscalls.gen.o syscall_filter.o signal_handler.o \
- bpf.o util.o
+ bpf.o util.o syscall_wrapper.o
clean: CLEAN(libminijailpreload.so)
CC_BINARY(syscall_filter_unittest): syscall_filter_unittest.o syscall_filter.o \