@@ -19,7 +19,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
19
19
20
20
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
21
21
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
22
- @@ -130 ,21 +130 ,11 @@ namespace sandbox {
22
+ @@ -138 ,21 +138 ,11 @@ namespace sandbox {
23
23
// present (as in newer versions of posix_spawn).
24
24
ResultExpr RestrictCloneToThreadsAndEPERMFork() {
25
25
const Arg<unsigned long> flags(0);
@@ -46,7 +46,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
46
46
47
47
// The following two flags are the two important flags in any vfork-emulating
48
48
// clone call. EPERM any clone call that contains both of them.
49
- @@ -154 ,7 +144 ,7 @@ ResultExpr RestrictCloneToThreadsAndEPER
49
+ @@ -162 ,7 +152 ,7 @@ ResultExpr RestrictCloneToThreadsAndEPER
50
50
AnyOf((flags & (CLONE_VM | CLONE_THREAD)) == 0,
51
51
(flags & kImportantCloneVforkFlags) == kImportantCloneVforkFlags);
52
52
@@ -92,8 +92,8 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
92
92
case __NR_readahead:
93
93
--- a/sandbox/linux/system_headers/arm64_linux_syscalls.h
94
94
+++ b/sandbox/linux/system_headers/arm64_linux_syscalls.h
95
- @@ -1119 ,4 +1119 ,8 @@
96
- #define __NR_rseq 293
95
+ @@ -1215 ,4 +1215 ,8 @@
96
+ #define __NR_landlock_restrict_self 446
97
97
#endif
98
98
99
99
+ #if !defined(__NR_membarrier)
@@ -103,8 +103,8 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
103
103
#endif // SANDBOX_LINUX_SYSTEM_HEADERS_ARM64_LINUX_SYSCALLS_H_
104
104
--- a/sandbox/linux/system_headers/arm_linux_syscalls.h
105
105
+++ b/sandbox/linux/system_headers/arm_linux_syscalls.h
106
- @@ -1605 ,6 +1605 ,10 @@
107
- #define __NR_mount_setattr (__NR_SYSCALL_BASE + 442 )
106
+ @@ -1617 ,6 +1617 ,10 @@
107
+ #define __NR_landlock_restrict_self (__NR_SYSCALL_BASE + 446 )
108
108
#endif
109
109
110
110
+ #if !defined(__NR_membarrier)
@@ -126,8 +126,8 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
126
126
#include "sandbox/linux/system_headers/x86_64_linux_syscalls.h"
127
127
--- a/sandbox/linux/system_headers/mips64_linux_syscalls.h
128
128
+++ b/sandbox/linux/system_headers/mips64_linux_syscalls.h
129
- @@ -1271 ,4 +1271 ,8 @@
130
- #define __NR_memfd_create (__NR_Linux + 314 )
129
+ @@ -1415 ,4 +1415 ,8 @@
130
+ #define __NR_landlock_restrict_self (__NR_Linux + 446 )
131
131
#endif
132
132
133
133
+ #if !defined(__NR_membarrier)
@@ -137,8 +137,8 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
137
137
#endif // SANDBOX_LINUX_SYSTEM_HEADERS_MIPS64_LINUX_SYSCALLS_H_
138
138
--- a/sandbox/linux/system_headers/mips_linux_syscalls.h
139
139
+++ b/sandbox/linux/system_headers/mips_linux_syscalls.h
140
- @@ -1685 ,4 +1685 ,8 @@
141
- #define __NR_mount_setattr (__NR_Linux + 442 )
140
+ @@ -1697 ,4 +1697 ,8 @@
141
+ #define __NR_landlock_restrict_self (__NR_Linux + 446 )
142
142
#endif
143
143
144
144
+ #if !defined(__NR_membarrier)
@@ -148,8 +148,8 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
148
148
#endif // SANDBOX_LINUX_SYSTEM_HEADERS_MIPS_LINUX_SYSCALLS_H_
149
149
--- a/sandbox/linux/system_headers/x86_64_linux_syscalls.h
150
150
+++ b/sandbox/linux/system_headers/x86_64_linux_syscalls.h
151
- @@ -1350 ,5 +1350 ,9 @@
152
- #define __NR_rseq 334
151
+ @@ -1438 ,5 +1438 ,9 @@
152
+ #define __NR_landlock_restrict_self 446
153
153
#endif
154
154
155
155
+ #if !defined(__NR_membarrier)
0 commit comments