Messages in this thread | | | Subject | Re: [PATCH v3 2/3] seccomp_filters: system call filtering using BPF | From | Eric Paris <> | Date | Fri, 13 Jan 2012 12:39:32 -0500 |
| |
On Thu, 2012-01-12 at 17:38 -0600, Will Drewry wrote:
> diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h > index cc7a4e9..0296871 100644 > --- a/include/linux/seccomp.h > +++ b/include/linux/seccomp.h
> -typedef struct { int mode; } seccomp_t; > +struct seccomp_filter; > +/** > + * struct seccomp_struct - the state of a seccomp'ed process > + * > + * @mode: > + * if this is 0, seccomp is not in use. > + * is 1, the process is under standard seccomp rules. > + * is 2, the process is only allowed to make system calls where > + * associated filters evaluate successfully. > + * @filter: Metadata for filter if using CONFIG_SECCOMP_FILTER. > + * @filter must only be accessed from the context of current as there > + * is no guard. > + */ > +typedef struct seccomp_struct { > + int mode; > +#ifdef CONFIG_SECCOMP_FILTER > + struct seccomp_filter *filter; > +#endif > +} seccomp_t; > > extern void __secure_computing(int); > static inline void secure_computing(int this_syscall)
Can we get rid of all of the typedef stuff? I know you didn't add it but now seems like a good time to follow typical kernel semantics if you have to re-rev for some other reason.
-Eric
| |