BACKPORT: seccomp,x86,arm,mips,s390: Remove nr parameter from secure_computing

The secure_computing function took a syscall number parameter, but
it only paid any attention to that parameter if seccomp mode 1 was
enabled.  Rather than coming up with a kludge to get the parameter
to work in mode 2, just remove the parameter.

To avoid churn in arches that don't have seccomp filters (and may
not even support syscall_get_nr right now), this leaves the
parameter in secure_computing_strict, which is now a real function.

For ARM, this is a bit ugly due to the fact that ARM conditionally
supports seccomp filters.  Fixing that would probably only be a
couple of lines of code, but it should be coordinated with the audit

This will be a slight slowdown on some arches.  The right fix is to
pass in all of seccomp_data instead of trying to make just the
syscall nr part be fast.

This is a prerequisite for making two-phase seccomp work cleanly.

Cc: Russell King <>
Cc: Ralf Baechle <>
Cc: Martin Schwidefsky <>
Cc: Heiko Carstens <>
Cc: Kees Cook <>
Signed-off-by: Andy Lutomirski <>
Signed-off-by: Kees Cook <>

Bug: 28020023
Patchset: seccomp

(cherry picked from kernel/msm commit 7ae89c27e2fa2ef24e374400d9e19aa4f1192f81)
Signed-off-by: Kees Cook <>
Change-Id: I9ada75ad967c3814fd0657077eee5a709d1549e9
6 files changed