/
githubmirror
/
libseccomp
Обзор
Документация
Войти
/
githubmirror
/
libseccomp
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
main
CHANGELOG
258 строк
12 KB
Tom Hromatka (Oracle)
doc: CHANGELOG entry for libseccomp v2.6.1
01 июл 2026, 22:09
01 июл 2026, 22:09
90d3f7d
Код
Авторство
О чём код?
libseccomp: Releases =============================================================================== https://github.com/seccomp/libseccomp * Version 2.6.1 - July 1, 2026 - Update the syscall table for Linux v7.1.0-rc4 - Fix incorrect 64-bit comparison merge that can weaken libseccomp filters. See GitHub Advisory GHSA-4q85-33p6-j5g6 - Fix issue where oversized libseccomp filters can trigger a double free. See GitHub Advisory GHSA-46fr-jh49-xvhx - Fix issue where oversized libseccomp filters can trigger a heap corruption. See GitHub Advisory GHSA-2hqh-5c36-grrm - Fix struct aliasing undefined behavior in the internal libseccomp hash algorithm - Fix issue where extraneous bytes were being copied to the destination buffer in seccomp_export_bpf_mem() - Fix a bug where merged libseccomp filters failed to merge the notify_used flag, leading to no listener file descriptor being generated - Update python shebang to point to python3 - Add documentation for seccomp_transaction_start() - Since support for s390 has been removed from the upstream Linux kernel, freeze libseccomp's s390 syscall table at Linux v6.18 * Version 2.6.0 - January 23, 2025 - Update the syscall table for Linux v6.13 - Add support for new arches: SuperH little and big endian, LoongArch, and 32-bit Motorola 68000 - Add multiplexed syscall support for more arches: MIPS, SuperH, and PPC - Consolidate and simplify handling of multiplexed syscalls - Add support for the SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV flag - Add support for transactions with the seccomp_transaction_start(), seccomp_transaction_commit(), and seccomp_transaction_reject() APIs - Add a seccomp_export_bpf_mem() API to generate the seccomp BPF filter and export it to a caller supplied memory buffer - Add a seccomp_precompute() API to generate the seccomp BPF filter prior to seccomp_load() or seccomp_export_bpf_mem() - Add support for binary tree filters without syscalls - Add support for the kernel’s implementation change of SECCOMP_IOCTL_NOTIF_ID_VALID - Add Python binding support for retrieving the notification file descriptor - Improved tooling to help track syscall table updates in the Linux kernel - Handle EINVAL error from the kernel when the WAIT_KILLABLE_RECV flag is erroneously provided to the kernel - Fix a seccomp userspace notification issue where the file descriptor was being requested more than once - Fix a bug where the internal filter state could be corrupted when a filter rule addition fails - Fix potential memory leak in the internal management of filter snapshots - Utilize Cython rather than distutils in the Python bindings, due to distutils’ deprecation - Many test and CI improvements and fixes - Many documentation improvements and updates * Version 2.5.6 - January 24, 2025 - Update the syscall table for Linux v6.13 - Fix a bug where the internal filter state could be corrupted when a filter rule addition fails - Fix potential memory leak in the internal management of filter snapshots * Version 2.5.5 - December 1, 2023 - Update the syscall table for Linux v6.7-rc3 * Version 2.5.4 - April 21, 2022 - Update the syscall table for Linux v5.17 - Fix minor issues with binary tree testing and with empty binary trees - Minor documentation improvements including retiring the mailing list * Version 2.5.3 - November 5, 2021 - Update the syscall table for Linux v5.15 - Fix issues with multiplexed syscalls on mipsel introduced in v2.5.2 - Document that seccomp_rule_add() may return -EACCES - Fix issues with test 11-basic-basic_errors on old kernels (API level < 5) * Version 2.5.2 - August 31, 2021 - Update the syscall table for Linux v5.14-rc7 - Add a function, get_notify_fd(), to the Python bindings to get the nofication file descriptor - Consolidate multiplexed syscall handling for all architectures into one location - Add multiplexed syscall support to PPC - Add multiplexed syscall support to MIPS - The meaning of SECCOMP_IOCTL_NOTIF_ID_VALID changed within the kernel. Modify the libseccomp file descriptor notification logic to support the kernel's previous and new usage of SECCOMP_IOCTL_NOTIF_ID_VALID * Version 2.5.1 - November 20, 2020 - Fix a bug where seccomp_load() could only be called once - Change the notification fd handling to only request a notification fd if the filter has a _NOTIFY action - Add documentation about SCMP_ACT_NOTIFY to the seccomp_add_rule(3) manpage - Clarify the maintainers' GPG keys * Version 2.5.0 - July 20, 2020 - Add support for the seccomp user notifications, see the seccomp_notify_alloc(3), seccomp_notify_receive(3), seccomp_notify_respond(3) manpages for more information - Add support for new filter optimization approaches, including a balanced tree optimization, see the SCMP_FLTATR_CTL_OPTIMIZE filter attribute for more information - Add support for the 64-bit RISC-V architecture - Performance improvements when adding new rules to a filter thanks to the use of internal shadow transactions and improved syscall lookup tables - Properly document the libseccomp API return values and include them in the stable API promise - Improvements to the s390 and s390x multiplexed syscall handling - Multiple fixes and improvements to the libseccomp manpages - Moved from manually maintained syscall tables to an automatically generated syscall table in CSV format - Update the syscall tables to Linux v5.8.0-rc5 - Python bindings and build now default to Python 3.x - Improvements to the tests have boosted code coverage to over 93% - Enable Travis CI testing on the aarch64 and ppc64le architectures - Add code inspection via lgtm.com * Version 2.4.3 - March 4, 2020 - Add list of authorized release signatures to README.md - Fix multiplexing issue with s390/s390x shm* syscalls - Remove the static flag from libseccomp tools compilation - Add define for __SNR_ppoll - Update our Travis CI configuration to use Ubuntu 18.04 - Disable live python tests in Travis CI - Use default python, rather than nightly python, in TravisCI - Fix potential memory leak identified by clang in the scmp_bpf_sim tool * Version 2.4.2 - November 7, 2019 - Update the syscall table for Linux v5.4-rc4 - Stop defining __NR_x values for syscalls that don't exist. Libseccomp now uses __SNR_x internally - Update the Cython language level to "3str" - Add support for io-uring related system calls - Clarify the maintainer documentation and release process - Fix python module name issue introduced in the v2.4.0 release. The module is now named "seccomp" as it was previously - Deliver the SECURITY.md file in releases * Version 2.4.1 - April 17, 2019 - Fix a BPF generation bug where the optimizer mistakenly identified duplicate BPF code blocks * Version 2.4.0 - March 14, 2019 - Update the syscall table for Linux v5.0-rc5 - Added support for the SCMP_ACT_KILL_PROCESS action - Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute - Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension - Added support for the parisc and parisc64 architectures - Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3) - Return -EDOM on an endian mismatch when adding an architecture to a filter - Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run() - Fix PFC generation when a syscall is prioritized, but no rule exists - Numerous fixes to the seccomp-bpf filter generation code - Switch our internal hashing function to jhash/Lookup3 to MurmurHash3 - Numerous tests added to the included test suite, coverage now at ~92% - Update our Travis CI configuration to use Ubuntu 16.04 - Numerous documentation fixes and updates * Version 2.3.3 - January 10, 2018 - Updated the syscall table for Linux v4.15-rc7 * Version 2.3.2 - February 27, 2017 - Achieved full compliance with the CII Best Practices program - Added Travis CI builds to the GitHub repository - Added code coverage reporting with the "--enable-code-coverage" configure flag and added Coveralls to the GitHub repository - Updated the syscall tables to match Linux v4.10-rc6+ - Support for building with Python v3.x - Allow rules with the -1 syscall if the SCMP_FLTATR_API_TSKIP attribute is set to true - Several small documentation fixes * Version 2.3.1 - April 20, 2016 - Fixed a problem with 32-bit x86 socket syscalls on some systems - Fixed problems with ipc syscalls on 32-bit x86 - Fixed problems with socket and ipc syscalls on s390 and s390x * Version 2.3.0 - February 29, 2016 - Added support for the s390 and s390x architectures - Added support for the ppc, ppc64, and ppc64le architectures - Update the internal syscall tables to match the Linux 4.5-rcX releases - Filter generation for both multiplexed and direct socket syscalls on x86 - Support for the musl libc implementation - Additions to the API to enable runtime version checking of the library - Enable the use of seccomp() instead of prctl() on supported systems - Added additional tests to the regression test suite * Version 2.2.3 - July 8, 2015 - Fix a problem with 'make check' on 32-bit ARM systems * Version 2.2.2 - July 6, 2015 - Fix a problem with the masked equality operator - Fix a problem on x86_64/x32 involving invalid architectures - Fix a problem with the ARM specific syscalls - Fix a build problem when the source and build directories differ * Version 2.2.1 - May 13, 2015 - Fix a problem with syscall argument filtering on 64-bit systems - Fix some problems with the 32-bit ARM syscall table - Fix build problems on very old systems - Update the README file with the GitHub and Google Groups information * Version 2.2.0 - February 12, 2015 - Migrated the build system to autotools - Added support for the aarch64 architecture - Added support for the mips, mips64, and mips64n32 architectures for both big and little endian systems - Added support for using the new seccomp() syscall and the thread sync functionality - Added Python bindings - Updated the internal syscall tables to Linux v3.19 - Added documentation to help contributors wishing to submit patches - Migrated to GitHub for git hosting and Google Groups for the mailing list - Numerous minor bug fixes * Version 2.1.1 - October 31, 2013 - Build system improvements - Automated test improvements, including a "check" target for use by packagers to verify the build - Numerous bug fixes related to the filter's internal rule database which affect those creating rules with syscall arguments - Introduced tools to verify the style/formatting of the code, including a "check-syntax" target for use by developers - Non-public symbols are now hidden in the library * Version 2.1.0 - June 11, 2013 - Add support for the x32 and ARM architectures - Improvements to the regression tests, including support for live tests - More verbose PFC output, including translation of syscall numbers to names - Several assorted bugfixes affecting the seccomp BPF generation - The syscall number/name resolver tool is now available to install * Version 2.0.0 - January 28, 2013 - Fixes for the x86 multiplexed syscalls - Additions to the API to better support non-native architectures - Additions to the API to support multiple architectures in one filter - Additions to the API to resolve syscall name/number mappings - Assorted minor bug fixes - Improved build messages regardless of build verbosity - More automated tests added as well as a number of improvements to the test harness * Version 1.0.1 - November 12, 2012 - The header file is now easier to use with C++ compilers - Minor documentation fixes - Minor memory leak fixes - Corrected x86 filter generation on x86_64 systems - Corrected problems with small filters and filters with arguments * Version 1.0.0 - July 31, 2012 - Change the API to be context-aware; eliminates all internal state but breaks compatibility with the previous 0.1.0 release - Added support for multiple build jobs ("make -j8") and verbose builds using the "V=1" build variable ("make V=1") - Minor tweaks to the regression test script output * Version 0.1.0 - June 8, 2012 - Initial release