Created attachment 343962 [details] [review]
tracker-seccomp: Add checks for mlock2() and getrandom() syscalls

On older kernels, these syscalls did not exist, so the __NR_* syscall
number definition does not exist for them, and compilation fails. Make
the seccomp rules for them conditional on the syscall numbers existing.

Comment on attachment 343962 [details] [review]
tracker-seccomp: Add checks for mlock2() and getrandom() syscalls

Looks good, thanks for looking into this :)

Attachment 343962 [details] pushed as fd995f8 - tracker-seccomp: Add checks for mlock2() and getrandom() syscalls

Alternatively, we could perhaps use seccomp_syscall_resolve_name to resolve the syscalls. Then we're independent on the exact kernel headers tracker is built against.

That would be a much better solution; I didn’t realise that function existed.

Oh, me neither, thanks for the tip Alex :). I indeed prefer that solution, shall you Philip or shall I? :)

Anyway, very glad to see tracker being correctly built by j.f.o now \o/.

Created attachment 344027 [details] [review]
tracker-seccomp: Rewrap macros to make them clearer

This introduces no functional changes.

Created attachment 344028 [details] [review]
tracker-seccomp: Check syscall availability at runtime not compile time

This makes our seccomp() protection independent of the exact kernel
version Tracker is built against.

Comment on attachment 344028 [details] [review]
tracker-seccomp: Check syscall availability at runtime not compile time

Looks good :). Perhaps some further checks could be done in the special cases below, but that can be handled separately.

Attachment 344027 [details] pushed as bb65466 - tracker-seccomp: Rewrap macros to make them clearer
Attachment 344028 [details] pushed as 0eb74c1 - tracker-seccomp: Check syscall availability at runtime not compile time