Messages in this thread | | | Date | Thu, 5 May 2011 08:14:06 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH 5/7] seccomp_filter: Document what seccomp_filter is and how it works. |
| |
Quoting Will Drewry (wad@chromium.org): > In particular, if the userspace code wants to stage some filters and > apply them all at once, when ready, I'm not sure that it makes sense > to me to put that complexity in the kernel itself. For instance,
Hi Will,
just one note - in my original comment I wasn't actually suggesting disabling setting of filters through a writeable file - I was only suggesting restricting writing to one's own filters file.
All the better if it is possible to get a nice prctl-only interface, but if it ends up limiting rule expressiveness (or taking years to define an interface) then perhaps we should stick with prctl for setting seccomp mode, and a more expressive file interface for defining filters.
-serge
| |