Messages in this thread | | | Subject | Re: [PATCH v5 2/3] seccomp_filters: system call filtering using BPF | From | Cong Wang <> | Date | Sat, 28 Jan 2012 19:21:09 +0800 |
| |
On Fri, 2012-01-27 at 17:24 -0600, Will Drewry wrote: > +config SECCOMP_FILTER > + bool "Enable seccomp-based system call filtering" > + select SECCOMP
Is 'depends on SECCOMP' better?
> + help > + This option provide support for limiting the accessibility > of
s/provide/provides/
> + systems calls at a task-level using a dynamically defined > policy.
s/systems/system/
> + > + System call filtering policy is expressed by the user using > + a Berkeley Packet Filter program. The program is attached > using
s/the user using//
> + prctl(2). For every system call the task makes, its number, > + arguments, and other metadata will be evaluated by the > attached > + filter program. The result determines if the system call > may > + may proceed or if the task should be terminated.
One more "may"... and "be proceeded"
> + > + This behavior is meant to aid security-conscious software in > + its ability to minimize the risk of running potentially > + risky code. > + > + See Documentation/prctl/seccomp_filter.txt for more detail. > +
Thanks.
| |