seccomp: more comprehensive protection against libseccomp's __NR_xyz namespace invasion

[thirdparty/systemd.git] / src / basic / missing_syscall.h

diff --git a/src/basic/missing_syscall.h b/src/basic/missing_syscall.h
index 6d9b12544d23cded17afc123cee2c84fcce33ddd..1255d8b1972cca6cfd3f1d579974114ac4cdfde8 100644 (file)
--- a/src/basic/missing_syscall.h
+++ b/src/basic/missing_syscall.h
@@ -274,7 +274,7 @@ static inline int missing_renameat2(int oldfd, const char *oldname, int newfd, c
 
 #if !HAVE_KCMP
 static inline int missing_kcmp(pid_t pid1, pid_t pid2, int type, unsigned long idx1, unsigned long idx2) {
-#  ifdef __NR_kcmp
+#  if defined __NR_kcmp && __NR_kcmp > 0
         return syscall(__NR_kcmp, pid1, pid2, type, idx1, idx2);
 #  else
         errno = ENOSYS;
@@ -289,7 +289,7 @@ static inline int missing_kcmp(pid_t pid1, pid_t pid2, int type, unsigned long i
 
 #if !HAVE_KEYCTL
 static inline long missing_keyctl(int cmd, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5) {
-#  ifdef __NR_keyctl
+#  if defined __NR_keyctl && __NR_keyctl > 0
         return syscall(__NR_keyctl, cmd, arg2, arg3, arg4, arg5);
 #  else
         errno = ENOSYS;
@@ -300,7 +300,7 @@ static inline long missing_keyctl(int cmd, unsigned long arg2, unsigned long arg
 }
 
 static inline key_serial_t missing_add_key(const char *type, const char *description, const void *payload, size_t plen, key_serial_t ringid) {
-#  ifdef __NR_add_key
+#  if defined __NR_add_key && __NR_add_key > 0
         return syscall(__NR_add_key, type, description, payload, plen, ringid);
 #  else
         errno = ENOSYS;
@@ -311,7 +311,7 @@ static inline key_serial_t missing_add_key(const char *type, const char *descrip
 }
 
 static inline key_serial_t missing_request_key(const char *type, const char *description, const char * callout_info, key_serial_t destringid) {
-#  ifdef __NR_request_key
+#  if defined __NR_request_key && __NR_request_key > 0
         return syscall(__NR_request_key, type, description, callout_info, destringid);
 #  else
         errno = ENOSYS;
@@ -496,7 +496,7 @@ enum {
 static inline long missing_set_mempolicy(int mode, const unsigned long *nodemask,
                            unsigned long maxnode) {
         long i;
-#  ifdef __NR_set_mempolicy
+#  if defined __NR_set_mempolicy && __NR_set_mempolicy > 0
         i = syscall(__NR_set_mempolicy, mode, nodemask, maxnode);
 #  else
         errno = ENOSYS;