v7
2026-07-25
seccomp非协作式参数重定向 · v7
提交v7系列seccomp补丁，引入SECCOMP_IOCTL_NOTIF_PIN_INSTALL和pinned-memfd重定向机制。
原始补丁链接
子 Patch（8）
1/8
mm: pass the target mm parameter through get_unmapped_area family
From: Cong Wang cwang@multikernel.io Every placement callback in the mmap path implicitly resolves against current->mm, so a placement cannot be computed in another task’s address space. vm_mmap_re
2/8
mm: add __do_mmap() and vm_mmap_remote()/vm_munmap_remote()
From: Cong Wang cwang@multikernel.io Add __do_mmap(), a variant of do_mmap() that installs the mapping into a caller-supplied mm rather than current->mm; do_mmap() becomes a wrapper passing current
3/8
seccomp: introduce SECCOMP_IOCTL_NOTIF_PIN_INSTALL
From: Cong Wang cwang@multikernel.io SECCOMP_IOCTL_NOTIF_PIN_INSTALL maps a supervisor-owned @memfd at @target_addr in the trapped task’s mm via vm_mmap_remote(), PROT_READ, MAP_SHARED, MAP_FIXED_N
4/8
seccomp: add __NR_seccomp_* aliases for rt_sigreturn and clone/fork
From: Cong Wang cwang@multikernel.io The existing _NR_seccomp* aliases name only the strict-mode syscalls (read/write/exit/sigreturn). SEND_REDIRECT must also recognise rt_sigreturn and the clone
5/8
seccomp: add kernel-installed pinned-memfd redirect
From: Cong Wang cwang@multikernel.io Add SECCOMP_IOCTL_NOTIF_SEND_REDIRECT, which resumes a trapped syscall (like SECCOMP_USER_NOTIF_FLAG_CONTINUE) with selected argument registers rewritten to poi
6/8
seccomp: re-validate a redirected syscall against outer filters
From: Cong Wang cwang@multikernel.io Stacked filters compose by taking the most restrictive verdict over one evaluation of a single seccomp_data, assuming the syscall they voted on is the syscall t
7/8
docs/seccomp: document pinned-memfd redirect ioctls
From: Cong Wang cwang@multikernel.io Document SECCOMP_IOCTL_NOTIF_PIN_INSTALL and SECCOMP_IOCTL_NOTIF_SEND_REDIRECT in the userspace API guide: the SECCOMP_FILTER_FLAG_REDIRECT opt-in and the singl
8/8
selftests/seccomp: cover non-cooperative pinned-memfd install
From: Cong Wang cwang@multikernel.io Add 11 tests for SECCOMP_IOCTL_NOTIF_PIN_INSTALL and SECCOMP_IOCTL_NOTIF_SEND_REDIRECT: - pinned_memfd_remote: basic install + redirect, plus the unsealed