Add support for SECCOMP_FILTER_FLAG_TSYNC.
This allows synchronizing all threads in a thread group to the same
seccomp filter tree.
Some processes only receive control over their execution after
threads have already been created in their thread group. This happens
for example with apps forked from the Android zygote.
Thread sync (TSYNC) allows these processes to safely apply seccomp
filters to all threads in their thread group, therefore preventing
a thread running with seccomp filters from being able to circumvent
the filter by exploiting an unconfined thread in the same thread
group.
Bug: 31267783
Test: Manual, with multithreaded program calling libminijail.
Change-Id: I902428abf2e4d7fb3e2200ebfe9d5e640a1b10e0
diff --git a/syscall_wrapper.c b/syscall_wrapper.c
new file mode 100644
index 0000000..1a8aea6
--- /dev/null
+++ b/syscall_wrapper.c
@@ -0,0 +1,25 @@
+/* Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "syscall_wrapper.h"
+
+#define _GNU_SOURCE
+#include <sys/syscall.h>
+#include <unistd.h>
+
+int sys_seccomp(unsigned int operation, unsigned int flags, void *args)
+{
+ return syscall(SYS_seccomp, operation, flags, args);
+}