script_core 0.0.6 → 0.1.0

data/ext/enterprise_script_service/libseccomp/doc/man/man3/seccomp_api_set.3

@@ -0,0 +1 @@
+.so man3/seccomp_api_get.3

data/ext/enterprise_script_service/libseccomp/doc/man/man3/seccomp_arch_add.3

@@ -128,4 +128,4 @@ Paul Moore <paul@paul-moore.com>
 .\" //////////////////////////////////////////////////////////////////////////
 .BR seccomp_init (3),
 .BR seccomp_reset (3),
-.BR seccom_merge (3)
+.BR seccomp_merge (3)

data/ext/enterprise_script_service/libseccomp/doc/man/man3/seccomp_attr_set.3

@@ -59,10 +59,11 @@ action.
 .TP
 .B SCMP_FLTATR_CTL_NNP
 A flag to specify if the NO_NEW_PRIVS functionality should be enabled before
-loading the seccomp filter into the kernel.  If set to off (
+loading the seccomp filter into the kernel.  Setting this to off (
 .I value
-== 0) then loading the seccomp filter into the kernel will fail if CAP_SYS_ADMIN
-is not set.  Defaults to on (
+== 0) results in no action, meaning that loading the seccomp filter into the
+kernel will fail if CAP_SYS_ADMIN is missing and NO_NEW_PRIVS has not been
+externally set.  Defaults to on (
 .I value
 == 1).
 .TP
@@ -76,6 +77,23 @@ greater; attempting to enable this flag on earlier kernels will result in an
 error being returned.  Defaults to off (
 .I value
 == 0).
+.TP
+.B SCMP_FLTATR_API_TSKIP
+A flag to specify if libseccomp should allow filter rules to be created for
+the -1 syscall.  The -1 syscall value can be used by tracer programs to skip
+specific syscall invocations, see
+.BR seccomp (2)
+for more information.  Defaults to off (
+.I value
+== 0).
+.TP
+.B SCMP_FLTATR_CTL_LOG
+A flag to specify if the kernel should log all filter actions taken except for
+the
+.BR SCMP_ACT_ALLOW
+action. Defaults to off (
+.I value
+== 0).
 .\" //////////////////////////////////////////////////////////////////////////
 .SH RETURN VALUE
 .\" //////////////////////////////////////////////////////////////////////////
@@ -129,4 +147,5 @@ Paul Moore <paul@paul-moore.com>
 .\" //////////////////////////////////////////////////////////////////////////
 .BR seccomp_init (3),
 .BR seccomp_reset (3),
-.BR seccomp_load (3)
+.BR seccomp_load (3),
+.BR seccomp (2)

data/ext/enterprise_script_service/libseccomp/doc/man/man3/seccomp_init.3

@@ -52,6 +52,10 @@ The thread will be terminated by the kernel with SIGSYS when it calls a syscall
 that does not match any of the configured seccomp filter rules.  The thread
 will not be able to catch the signal.
 .TP
+.B SCMP_ACT_KILL_PROCESS
+The entire process will be terminated by the kernel with SIGSYS when it calls a
+syscall that does not match any of the configured seccomp filter rules.
+.TP
 .B SCMP_ACT_TRAP
 The thread will be sent a SIGSYS signal when it calls a syscall that does not
 match any of the configured seccomp filter rules.  It may catch this and change
@@ -79,6 +83,11 @@ can be retrieved using the
 .B PTRACE_GETEVENTMSG
 option.
 .TP
+.B SCMP_ACT_LOG
+The seccomp filter will have no effect on the thread calling the syscall if it
+does not match any of the configured seccomp filter rules but the syscall will
+be logged.
+.TP
 .B SCMP_ACT_ALLOW
 The seccomp filter will have no effect on the thread calling the syscall if it
 does not match any of the configured seccomp filter rules.

data/ext/enterprise_script_service/libseccomp/doc/man/man3/seccomp_merge.3

@@ -27,9 +27,9 @@ with the filter in
 .I dst
 and stores the resulting in the
 .I dst
-filter.  If successfull, the
+filter.  If successful, the
 .I src
-seccomp filter is released and all internal memory assocated with the filter
+seccomp filter is released and all internal memory associated with the filter
 is freed; there is no need to call
 .BR seccomp_release (3)
 on

data/ext/enterprise_script_service/libseccomp/doc/man/man3/seccomp_rule_add.3

@@ -1,4 +1,4 @@
-.TH "seccomp_rule_add" 3 "25 July 2012" "paul@paul-moore.com" "libseccomp Documentation"
+.TH "seccomp_rule_add" 3 "17 February 2019" "paul@paul-moore.com" "libseccomp Documentation"
 .\" //////////////////////////////////////////////////////////////////////////
 .SH NAME
 .\" //////////////////////////////////////////////////////////////////////////
@@ -22,6 +22,24 @@ seccomp_rule_add, seccomp_rule_add_exact \- Add a seccomp filter rule
 .BI "struct scmp_arg_cmp SCMP_A4(enum scmp_compare " op ", " ... ");"
 .BI "struct scmp_arg_cmp SCMP_A5(enum scmp_compare " op ", " ... ");"
 .sp
+.BI "struct scmp_arg_cmp SCMP_CMP64(unsigned int " arg ","
+.BI "                             enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A0_64(enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A1_64(enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A2_64(enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A3_64(enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A4_64(enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A5_64(enum scmp_compare " op ", " ... ");"
+.sp
+.BI "struct scmp_arg_cmp SCMP_CMP32(unsigned int " arg ","
+.BI "                             enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A0_32(enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A1_32(enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A2_32(enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A3_32(enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A4_32(enum scmp_compare " op ", " ... ");"
+.BI "struct scmp_arg_cmp SCMP_A5_32(enum scmp_compare " op ", " ... ");"
+.sp
 .BI "int seccomp_rule_add(scmp_filter_ctx " ctx ", uint32_t " action ","
 .BI "                     int " syscall ", unsigned int " arg_cnt ", " ... ");"
 .BI "int seccomp_rule_add_exact(scmp_filter_ctx " ctx ", uint32_t " action ","
@@ -53,8 +71,8 @@ functions all add a new filter rule to the current seccomp filter.  The
 and
 .BR seccomp_rule_add_array ()
 functions will make a "best effort" to add the rule as specified, but may alter
-the rule slightly due to architecture specifics, e.g. socket and ipc functions
-on x86.  The
+the rule slightly due to architecture specifics (e.g. internal rewriting of
+multiplexed syscalls, like socket and ipc functions on x86).  The
 .BR seccomp_rule_add_exact ()
 and
 .BR seccomp_rule_add_exact_array ()
@@ -71,15 +89,36 @@ loaded into the kernel using
 .BR seccomp_load (3).
 .P
 The
+.BR SCMP_CMP (),
+.BR SCMP_CMP64 (),
+.BR SCMP_A{0-5} (),
+and
+.BR SCMP_A{0-5}_64 ()
+macros generate a scmp_arg_cmp structure for use with the above functions. The
 .BR SCMP_CMP ()
 and
+.BR SCMP_CMP64 ()
+macros allows the caller to specify an arbitrary argument along with the
+comparison operator, 64-bit mask, and 64-bit datum values where the
 .BR SCMP_A{0-5} ()
-macros generate a scmp_arg_cmp structure for use with the above functions. The
+and
+.BR SCMP_A{0-5}_64 ()
+macros are specific to a certain argument.
+.P
+The
+.BR SCMP_CMP32 ()
+and
+.BR SCMP_A{0-5}_32 ()
+macros are similar to the variants above, but they take 32-bit mask and 32-bit
+datum values.
+.P
+It is recommended that whenever possible developers avoid using the
 .BR SCMP_CMP ()
-macro allows the caller to specify an arbitrary argument along with the
-comparison operator, mask, and datum values where the
+and
 .BR SCMP_A{0-5} ()
-macros are specific to a certain argument.  See the EXAMPLES section below.
+macros and use the variants which are explicitly 32 or 64-bit.  This should
+help eliminate problems caused by an unwanted sign extension of negative datum
+values.
 .P
 While it is possible to specify the
 .I syscall
@@ -90,6 +129,14 @@ is highly recommended to use the
 .BR SCMP_SYS ()
 macro instead.  See the EXAMPLES section below.
 .P
+Starting with Linux v4.8, there may be a need to create a rule with a syscall
+value of -1 to allow tracing programs to skip a syscall invocation; in order
+to create a rule with a -1 syscall value it is necessary to first set the
+.B SCMP_FLTATR_API_TSKIP
+attribute.  See
+.BR seccomp_attr_set (3)
+for more information.
+.P
 The filter context
 .I ctx
 is the value returned by the call to
@@ -100,18 +147,21 @@ Valid
 values are as follows:
 .TP
 .B SCMP_ACT_KILL
-The thread will be killed by the kernel when it calls a syscall that does not
-match any of the configured seccomp filter rules.
+The thread will be killed by the kernel when it calls a syscall that matches
+the filter rule.
+.TP
+.B SCMP_ACT_KILL_PROCESS
+The process will be killed by the kernel when it calls a syscall that matches
+the filter rule.
 .TP
 .B SCMP_ACT_TRAP
-The thread will throw a SIGSYS signal when it calls a syscall that does not
-match any of the configured seccomp filter rules.
+The thread will throw a SIGSYS signal when it calls a syscall that matches the
+filter rule.
 .TP
 .B SCMP_ACT_ERRNO(uint16_t errno)
 The thread will receive a return value of
 .I errno
-when it calls a syscall that does not match any of the configured seccomp filter
-rules.
+when it calls a syscall that matches the filter rule.
 .TP
 .B SCMP_ACT_TRACE(uint16_t msg_num)
 If the thread is being traced and the tracing process specified the
@@ -126,9 +176,13 @@ can be retrieved using the
 .B PTRACE_GETEVENTMSG
 option.
 .TP
+.B SCMP_ACT_LOG
+The seccomp filter will have no effect on the thread calling the syscall if it
+matches the filter rule but the syscall will be logged.
+.TP
 .B SCMP_ACT_ALLOW
 The seccomp filter will have no effect on the thread calling the syscall if it
-does not match any of the configured seccomp filter rules.
+matches the filter rule.
 .P
 Valid comparison
 .I op
@@ -219,6 +273,7 @@ functions return zero on success, negative errno values on failure.
 #include <seccomp.h>
 #include <sys/stat.h>
 #include <sys/types.h>
+#include <stddef.h>
 
 #define BUF_SIZE	256
 
@@ -244,6 +299,14 @@ int main(int argc, char *argv[])
 	if (rc < 0)
 		goto out;
 
+	rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
+	if (rc < 0)
+		goto out;
+
+	rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit), 0);
+	if (rc < 0)
+		goto out;
+
 	rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 3,
 			      SCMP_A0(SCMP_CMP_EQ, fd),
 			      SCMP_A1(SCMP_CMP_EQ, (scmp_datum_t)buf),
@@ -291,5 +354,7 @@ Paul Moore <paul@paul-moore.com>
 .\" //////////////////////////////////////////////////////////////////////////
 .SH SEE ALSO
 .\" //////////////////////////////////////////////////////////////////////////
+.BR seccomp_syscall_resolve_name_rewrite (3),
 .BR seccomp_syscall_priority (3),
-.BR seccomp_load (3)
+.BR seccomp_load (3),
+.BR seccomp_attr_set (3)

data/ext/enterprise_script_service/libseccomp/doc/man/man3/seccomp_syscall_resolve_name.3

@@ -30,7 +30,12 @@ and
 functions resolve the commonly used syscall name to the syscall number used by
 the kernel and the rest of the libseccomp API, with
 .BR seccomp_syscall_resolve_name_rewrite()
-rewriting the syscall number for architectures that modify the syscall.  The
+rewriting the syscall number for architectures that modify the syscall.  Syscall
+rewriting typically happens in case of a multiplexed syscall, like
+.BR socketcall (2)
+or
+.BR ipc (2)
+on x86.
 .BR seccomp_syscall_resolve_num_arch()
 function resolves the syscall number used by the kernel to the commonly used
 syscall name.
@@ -100,6 +105,15 @@ out:
 .SH NOTES
 .\" //////////////////////////////////////////////////////////////////////////
 .P
+In case of bare syscalls implemented on top of a multiplexed syscall,
+.BR seccomp_syscall_resolve_name()
+and
+.BR seccomp_syscall_resolve_name_arch()
+can be used to verify if a bare syscall is implemented for a specific
+architecture, while
+.BR seccomp_syscall_resolve_name_rewrite()
+can be used to determine the underlying multiplexed syscall.
+.P
 While the seccomp filter can be generated independent of the kernel, kernel
 support is required to load and enforce the seccomp filter generated by
 libseccomp.

data/ext/enterprise_script_service/libseccomp/include/seccomp.h.in

@@ -63,6 +63,8 @@ enum scmp_filter_attr {
 	SCMP_FLTATR_ACT_BADARCH = 2,	/**< bad architecture action */
 	SCMP_FLTATR_CTL_NNP = 3,	/**< set NO_NEW_PRIVS on filter load */
 	SCMP_FLTATR_CTL_TSYNC = 4,	/**< sync threads on filter load */
+	SCMP_FLTATR_API_TSKIP = 5,	/**< allow rules with a -1 syscall */
+	SCMP_FLTATR_CTL_LOG = 6,	/**< log not-allowed actions */
 	_SCMP_FLTATR_MAX,
 };
 
@@ -184,50 +186,117 @@ struct scmp_arg_cmp {
 #define SCMP_ARCH_S390		AUDIT_ARCH_S390
 #define SCMP_ARCH_S390X		AUDIT_ARCH_S390X
 
+/**
+ * The PA-RISC hppa architecture tokens
+ */
+#define SCMP_ARCH_PARISC	AUDIT_ARCH_PARISC
+#define SCMP_ARCH_PARISC64	AUDIT_ARCH_PARISC64
+
 /**
  * Convert a syscall name into the associated syscall number
  * @param x the syscall name
  */
 #define SCMP_SYS(x)		(__NR_##x)
 
+/* Helpers for the argument comparison macros, DO NOT USE directly */
+#define _SCMP_VA_NUM_ARGS(...)	_SCMP_VA_NUM_ARGS_IMPL(__VA_ARGS__,2,1)
+#define _SCMP_VA_NUM_ARGS_IMPL(_1,_2,N,...)	N
+#define _SCMP_MACRO_DISPATCHER(func, ...) \
+	_SCMP_MACRO_DISPATCHER_IMPL1(func, _SCMP_VA_NUM_ARGS(__VA_ARGS__))
+#define _SCMP_MACRO_DISPATCHER_IMPL1(func, nargs) \
+	_SCMP_MACRO_DISPATCHER_IMPL2(func, nargs)
+#define _SCMP_MACRO_DISPATCHER_IMPL2(func, nargs) \
+	func ## nargs
+#define _SCMP_CMP32_1(x, y, z) \
+	SCMP_CMP64(x, y, (uint32_t)(z))
+#define _SCMP_CMP32_2(x, y, z, q) \
+	SCMP_CMP64(x, y, (uint32_t)(z), (uint32_t)(q))
+
 /**
- * Specify an argument comparison struct for use in declaring rules
+ * Specify a 64-bit argument comparison struct for use in declaring rules
  * @param arg the argument number, starting at 0
  * @param op the comparison operator, e.g. SCMP_CMP_*
  * @param datum_a dependent on comparison
  * @param datum_b dependent on comparison, optional
  */
-#define SCMP_CMP(...)		((struct scmp_arg_cmp){__VA_ARGS__})
+#define SCMP_CMP64(...)		((struct scmp_arg_cmp){__VA_ARGS__})
+#define SCMP_CMP		SCMP_CMP64
+
+/**
+ * Specify a 32-bit argument comparison struct for use in declaring rules
+ * @param arg the argument number, starting at 0
+ * @param op the comparison operator, e.g. SCMP_CMP_*
+ * @param datum_a dependent on comparison (32-bits)
+ * @param datum_b dependent on comparison, optional (32-bits)
+ */
+#define SCMP_CMP32(x, y, ...) \
+	_SCMP_MACRO_DISPATCHER(_SCMP_CMP32_, __VA_ARGS__)(x, y, __VA_ARGS__)
+
+/**
+ * Specify a 64-bit argument comparison struct for argument 0
+ */
+#define SCMP_A0_64(...)		SCMP_CMP64(0, __VA_ARGS__)
+#define SCMP_A0			SCMP_A0_64
 
 /**
- * Specify an argument comparison struct for argument 0
+ * Specify a 32-bit argument comparison struct for argument 0
  */
-#define SCMP_A0(...)		SCMP_CMP(0, __VA_ARGS__)
+#define SCMP_A0_32(x, ...)	SCMP_CMP32(0, x, __VA_ARGS__)
 
 /**
- * Specify an argument comparison struct for argument 1
+ * Specify a 64-bit argument comparison struct for argument 1
  */
-#define SCMP_A1(...)		SCMP_CMP(1, __VA_ARGS__)
+#define SCMP_A1_64(...)		SCMP_CMP64(1, __VA_ARGS__)
+#define SCMP_A1			SCMP_A1_64
 
 /**
- * Specify an argument comparison struct for argument 2
+ * Specify a 32-bit argument comparison struct for argument 1
  */
-#define SCMP_A2(...)		SCMP_CMP(2, __VA_ARGS__)
+#define SCMP_A1_32(x, ...)	SCMP_CMP32(1, x, __VA_ARGS__)
 
 /**
- * Specify an argument comparison struct for argument 3
+ * Specify a 64-bit argument comparison struct for argument 2
  */
-#define SCMP_A3(...)		SCMP_CMP(3, __VA_ARGS__)
+#define SCMP_A2_64(...)		SCMP_CMP64(2, __VA_ARGS__)
+#define SCMP_A2			SCMP_A2_64
 
 /**
- * Specify an argument comparison struct for argument 4
+ * Specify a 32-bit argument comparison struct for argument 2
  */
-#define SCMP_A4(...)		SCMP_CMP(4, __VA_ARGS__)
+#define SCMP_A2_32(x, ...)	SCMP_CMP32(2, x, __VA_ARGS__)
 
 /**
- * Specify an argument comparison struct for argument 5
+ * Specify a 64-bit argument comparison struct for argument 3
  */
-#define SCMP_A5(...)		SCMP_CMP(5, __VA_ARGS__)
+#define SCMP_A3_64(...)		SCMP_CMP64(3, __VA_ARGS__)
+#define SCMP_A3			SCMP_A3_64
+
+/**
+ * Specify a 32-bit argument comparison struct for argument 3
+ */
+#define SCMP_A3_32(x, ...)	SCMP_CMP32(3, x, __VA_ARGS__)
+
+/**
+ * Specify a 64-bit argument comparison struct for argument 4
+ */
+#define SCMP_A4_64(...)		SCMP_CMP64(4, __VA_ARGS__)
+#define SCMP_A4			SCMP_A4_64
+
+/**
+ * Specify a 32-bit argument comparison struct for argument 4
+ */
+#define SCMP_A4_32(x, ...)	SCMP_CMP32(4, x, __VA_ARGS__)
+
+/**
+ * Specify a 64-bit argument comparison struct for argument 5
+ */
+#define SCMP_A5_64(...)		SCMP_CMP64(5, __VA_ARGS__)
+#define SCMP_A5			SCMP_A5_64
+
+/**
+ * Specify a 32-bit argument comparison struct for argument 5
+ */
+#define SCMP_A5_32(x, ...)	SCMP_CMP32(5, x, __VA_ARGS__)
 
 /*
  * seccomp actions
@@ -236,7 +305,15 @@ struct scmp_arg_cmp {
 /**
  * Kill the process
  */
-#define SCMP_ACT_KILL		0x00000000U
+#define SCMP_ACT_KILL_PROCESS	0x80000000U
+/**
+ * Kill the thread
+ */
+#define SCMP_ACT_KILL_THREAD	0x00000000U
+/**
+ * Kill the thread, defined for backward compatibility
+ */
+#define SCMP_ACT_KILL		SCMP_ACT_KILL_THREAD
 /**
  * Throw a SIGSYS signal
  */
@@ -249,6 +326,10 @@ struct scmp_arg_cmp {
  * Notify a tracing process with the specified value
  */
 #define SCMP_ACT_TRACE(x)	(0x7ff00000U | ((x) & 0x0000ffffU))
+/**
+ * Allow the syscall to be executed after the action has been logged
+ */
+#define SCMP_ACT_LOG		0x7ffc0000U
 /**
  * Allow the syscall to be executed
  */
@@ -267,6 +348,39 @@ struct scmp_arg_cmp {
  */
 const struct scmp_version *seccomp_version(void);
 
+/**
+ * Query the library's level of API support
+ *
+ * This function returns an API level value indicating the current supported
+ * functionality.  It is important to note that this level of support is
+ * determined at runtime and therefore can change based on the running kernel
+ * and system configuration (e.g. any previously loaded seccomp filters).  This
+ * function can be called multiple times, but it only queries the system the
+ * first time it is called, the API level is cached and used in subsequent
+ * calls.
+ *
+ * The current API levels are described below:
+ *  0 : reserved
+ *  1 : base level
+ *  2 : support for the SCMP_FLTATR_CTL_TSYNC filter attribute
+ *      uses the seccomp(2) syscall instead of the prctl(2) syscall
+ *  3 : support for the SCMP_FLTATR_CTL_LOG filter attribute
+ *      support for the SCMP_ACT_LOG action
+ *      support for the SCMP_ACT_KILL_PROCESS action
+ *
+ */
+unsigned int seccomp_api_get(void);
+
+/**
+ * Set the library's level of API support
+ *
+ * This function forcibly sets the API level of the library at runtime.  Valid
+ * API levels are discussed in the description of the seccomp_api_get()
+ * function.  General use of this function is strongly discouraged.
+ *
+ */
+int seccomp_api_set(unsigned int level);
+
 /**
  * Initialize the filter state
  * @param def_action the default filter action
@@ -360,8 +474,8 @@ int seccomp_arch_exist(const scmp_filter_ctx ctx, uint32_t arch_token);
  * Any new rules added after this function successfully returns will be added
  * to this architecture but existing rules will not be added to this
  * architecture.  If the architecture token is SCMP_ARCH_NATIVE then the native
- * architecture will be assumed.  Returns zero on success, negative values on
- * failure.
+ * architecture will be assumed.  Returns zero on success, -EEXIST if
+ * specified architecture is already present, other negative values on failure.
  *
  */
 int seccomp_arch_add(scmp_filter_ctx ctx, uint32_t arch_token);
@@ -1538,11 +1652,6 @@ int seccomp_export_bpf(const scmp_filter_ctx ctx, int fd);
 #define __NR_spu_run		__PNR_spu_run
 #endif /* __NR_spu_run */
 
-#define __PNR_subpage_prot	-10189
-#ifndef __NR_subpage_prot
-#define __NR_subpage_prot	__PNR_subpage_prot
-#endif /* __NR_subpage_prot */
-
 #define __PNR_swapcontext	-10190
 #ifndef __NR_swapcontext
 #define __NR_swapcontext	__PNR_swapcontext
@@ -1603,6 +1712,60 @@ int seccomp_export_bpf(const scmp_filter_ctx ctx, int fd);
 #define __NR_userfaultfd	__PNR_userfaultfd
 #endif /* __NR_userfaultfd */
 
+#define __PNR_pkey_mprotect	-10201
+#ifndef __NR_pkey_mprotect
+#define __NR_pkey_mprotect	__PNR_pkey_mprotect
+#endif /* __NR_pkey_mprotect */
+
+#define __PNR_pkey_alloc	-10202
+#ifndef __NR_pkey_alloc
+#define __NR_pkey_alloc	__PNR_pkey_alloc
+#endif /* __NR_pkey_alloc */
+
+#define __PNR_pkey_free		-10203
+#ifndef __NR_pkey_free
+#define __NR_pkey_free		__PNR_pkey_free
+#endif /* __NR_pkey_free */
+
+#define __PNR_get_tls		-10204
+#ifndef __NR_get_tls
+#ifdef __ARM_NR_get_tls
+#define __NR_get_tls		__ARM_NR_get_tls
+#else
+#define __NR_get_tls		__PNR_get_tls
+#endif
+#endif /* __NR_get_tls */
+
+#define __PNR_s390_guarded_storage	-10205
+#ifndef __NR_s390_guarded_storage
+#define __NR_s390_guarded_storage	__PNR_s390_guarded_storage
+#endif /* __NR_s390_guarded_storage */
+
+#define __PNR_s390_sthyi	-10206
+#ifndef __NR_s390_sthyi
+#define __NR_s390_sthyi		__PNR_s390_sthyi
+#endif /* __NR_s390_sthyi */
+
+#define __PNR_subpage_prot	-10207
+#ifndef __NR_subpage_prot
+#define __NR_subpage_prot	__PNR_subpage_prot
+#endif /* __NR_subpage_prot */
+
+#define __PNR_statx		-10208
+#ifndef __NR_statx
+#define __NR_statx		__PNR_statx
+#endif /* __NR_statx */
+
+#define __PNR_io_pgetevents	-10209
+#ifndef __NR_io_pgetevents
+#define __NR_io_pgetevents	__PNR_io_pgetevents
+#endif /* __NR_io_pgetevents */
+
+#define __PNR_rseq		-10210
+#ifndef __NR_rseq
+#define __NR_rseq		__PNR_rseq
+#endif /* __NR_rseq */
+
 #ifdef __cplusplus
 }
 #endif