genode/tool/seccomp/Makefile

.DEFAULT_GOAL := seccomp_bpf_filters

ARCHS := x86_32 x86_64 arm_32 arm_64

seccomp_bpf_filters: $(foreach A,$(ARCHS),seccomp_bpf_policy_$A.bin)

seccomp_bpf_policy_%.bin: seccomp_bpf_compiler_%.prg
	./$< > $@

seccomp_bpf_compiler_%.prg: seccomp_bpf_compiler_%.cc seccomp_bpf_compiler.h
	@g++ $< -o $@ -lseccomp

clean:
	@rm seccomp_bpf_policy_*.bin 2> /dev/null; true
	@rm seccomp_bpf_compiler_*.prg 2> /dev/null; true

.PHONY: seccomp_bpf_filters
base-linux: enabled seccomp base-linux uses seccomp to reduce the available system calls to the minimum set needed to run base-linux. There are still some syscalls that allow accessing global state which should be further reduced. The combination of seccomp and socket descriptor caps should provide an intermediate level of security for base-linux thereby enabling base-linux as a migration path from using the Linux kernel to the use of microkernel-based Genode. Fixes #3581 2019-09-17 12:40:52 +00:00			`.DEFAULT_GOAL := seccomp_bpf_filters`

base-linux: 64-bit ARM support This patch adds support for running Genode/Linux on the AARCH64 architecture. - The kernel-agnostic startup code (crt0) had to be extended to capture the initial stack pointer, which the Linux kernel uses to pass the process environment. This is in line with the existing startup code for x86_32 and x86_64. - The link order of the host libraries linked to lx_hybrid programs had to be adjusted such that libgcc appears at last because the other libraries depend on symbols provided by libgcc. - When using AARCH64 Linux as host, one can execute run scripts via 'make run/<script> KERNEL=linux BOARD=linux' now. Issue #4136 2021-05-05 17:20:37 +00:00			`ARCHS := x86_32 x86_64 arm_32 arm_64`

			`seccomp_bpf_filters: $(foreach A,$(ARCHS),seccomp_bpf_policy_$A.bin)`
base-linux: enabled seccomp base-linux uses seccomp to reduce the available system calls to the minimum set needed to run base-linux. There are still some syscalls that allow accessing global state which should be further reduced. The combination of seccomp and socket descriptor caps should provide an intermediate level of security for base-linux thereby enabling base-linux as a migration path from using the Linux kernel to the use of microkernel-based Genode. Fixes #3581 2019-09-17 12:40:52 +00:00
			`seccomp_bpf_policy_%.bin: seccomp_bpf_compiler_%.prg`
			`./$< > $@`

tool/seccomp: allow sigreturn on x86 Fixes #3799 2020-07-02 07:03:33 +00:00			`seccomp_bpf_compiler_%.prg: seccomp_bpf_compiler_%.cc seccomp_bpf_compiler.h`
base-linux: enabled seccomp base-linux uses seccomp to reduce the available system calls to the minimum set needed to run base-linux. There are still some syscalls that allow accessing global state which should be further reduced. The combination of seccomp and socket descriptor caps should provide an intermediate level of security for base-linux thereby enabling base-linux as a migration path from using the Linux kernel to the use of microkernel-based Genode. Fixes #3581 2019-09-17 12:40:52 +00:00			`@g++ $< -o $@ -lseccomp`

			`clean:`
			`@rm seccomp_bpf_policy_*.bin 2> /dev/null; true`
			`@rm seccomp_bpf_compiler_*.prg 2> /dev/null; true`
tool/seccomp: allow sigreturn on x86 Fixes #3799 2020-07-02 07:03:33 +00:00
			`.PHONY: seccomp_bpf_filters`