Files
codex/codex-rs
dhavalkapil-oai 1bda886113 Enforce Linux seccomp restrictions for x32 syscalls (#61206)
## Why

The x32 ABI shares the x86-64 audit architecture, so the architecture check alone does not enforce syscall restrictions for x32 callers.

## What changed

Apply existing syscall denials and socket-family conditions to x32 syscall numbers on x86-64, including separate x32 numbers and legacy aliases supported before Linux 5.4.

## Testing

Add probes across all three network seccomp modes to verify that restricted native and x32 calls return `EPERM`, allowed calls preserve their behavior, and socket-family restrictions apply to both ABIs.

GitOrigin-RevId: fa38138d6b6c7b26dfafd6c931880ee1265a1b94
2026-11-12 23:53:14 +00:00
..
…
…
…
…