emacs/lib-src, branch feature/native-comp

Fix Seccomp filter on CentOS 8.3 (Bug#47828).

2021-04-18T08:34:48+00:00

* lib-src/seccomp-filter.c (main): mmap: Also allow MAP_SHARED.

* lib-src/seccomp-filter.c: Add missing headers.

2021-04-12T07:20:51+00:00

Generate Seccomp filters only if we have the necessary constants.

2021-04-12T07:15:59+00:00

If we're missing SECCOMP_SET_MODE_FILTER, the seccomp-filter build
fails.  Reuse the existing HAVE_SECCOMP configuration variable, which
checks for these macros.

* configure.ac (HAVE_SECCOMP): Substitute in Makefile.in.
* lib-src/Makefile.in (HAVE_SECCOMP): New variable.
(SECCOMP_FILTER): Define only if HAVE_SECCOMP.

Add a variant of the Seccomp filter file that allows 'execve'.

2021-04-11T19:19:09+00:00

This is useful when starting Emacs with a Seccomp filter enabled,
e.g. using 'bwrap'.

* lib-src/seccomp-filter.c (main): Generate new Seccomp files.

* lib-src/Makefile.in (all)
(seccomp-filter.bpf seccomp-filter.pfc seccomp-filter-exec.bpf
seccomp-filter-exec.pfc): Generate new Seccomp files.

* .gitignore: Ignore new Seccomp files.

* test/src/emacs-tests.el (emacs-tests/bwrap/allows-stdout): New unit
test.

* lib-src/seccomp-filter.c (main): Also allow O_NOFOLLOW.

2021-04-11T19:14:41+00:00

Don't attempt to generate Seccomp filter file in Linux < 4.14.

2021-04-11T18:46:59+00:00

Only Linux 4.14 and later contain the required support for
SECCOMP_RET_KILL_PROCESS.

* lib-src/Makefile.in (SECCOMP_FILTER): Define only if we run at least
Linux 4.14.

Seccomp filter: allow reading the current time (Bug#47708).

2021-04-11T17:50:45+00:00

* lib-src/seccomp-filter.c (main): Allow reading the current time.

Use pkg-config to check for libseccomp.

2021-04-11T14:50:29+00:00

We need at list version 2.4.0 of libseccomp for seccomp-filter.c to
build cleanly.

* configure.ac: Use pkg-config to check for libseccomp.
* lib-src/Makefile.in (HAVE_LIBSECCOMP, LIBSECCOMP_LIBS)
(LIBSECCOMP_CFLAGS): New variables.
(SECCOMP_FILTER, seccomp-filter$(EXEEXT)): Use them.

Remove SCMP_FLTATR_CTL_LOG attribute from Seccomp filter.

2021-04-11T14:41:44+00:00

Whether or not we log failing syscalls isn't security-critical, and we
shouldn't care.

* lib-src/seccomp-filter.c (main): Remove log attribute.

Only attempt to generate seccomp filter files on x86-64 systems.

2021-04-11T14:25:09+00:00

The seccomp filters are always architecture-specific, and
seccomp-filter.c right now only supports x86-64.

* lib-src/Makefile.in (SECCOMP_FILTER): New variable.
(DONT_INSTALL, all, seccomp-filter$(EXEEXT)): Use it.