lkml.org 
[lkml]   [2012]   [Feb]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v10 05/11] seccomp: add system call filtering using BPF
    On 02/22/2012 11:47 AM, Will Drewry wrote:
    >>
    >> I highly disagree with every filter having to check the mode: Filters that
    >> don't check the arch on e.g. x86 are buggy, so they have to check it, even
    >> if it's a 32-bit or 64-bit only system, the filters can't know that and
    >> needs to check the arch at every syscall entry. All other info in the data
    >> depends on the arch, because of this there isn't much code to share between
    >> the two archs, so you can as well have one filter for each arch.
    >>
    >> Alternative approach: Tell the arch at filter install time and only run the
    >> filters with the same arch as the current system call. If no filters are run,
    >> deny the systemcall.
    >
    > This was roughly how I first implemented compat and non-compat
    > support. It causes some implicit behavior across inheritance that is
    > not nice though.
    >

    This is trivially doable at the BPF level, right? Just make this the
    first instruction in the program (either deny or jump to a separate
    program branch)... and then there is still "one program" without any
    weird inheritance issues?

    -hpa

    --
    H. Peter Anvin, Intel Open Source Technology Center
    I work for Intel. I don't speak on their behalf.



    \
     
     \ /
      Last update: 2012-02-22 20:57    [W:0.019 / U:59.108 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site