| Subject | Re: [PATCH 3/7] seccomp_filter: Enable ftrace-based system call filtering | From | Steven Rostedt <> | Date | Thu, 28 Apr 2011 12:28:16 -0400 |
| |
On Wed, 2011-04-27 at 22:08 -0500, Will Drewry wrote:
> The only other twist is that it is possible to delay enforcement by one > system call by supplying a "on_next_syscall: 1" 'filter'. This allows > for a launcher process to fork(), prctl(), then execve() leaving the > launched binary in a filtered state.
I wonder if the more "unixy" thing to do is, instead of on_next_sycall, have "enable_on_exec". Where the user could do multiple syscalls but the filter will not take place until an exec is made?
-- Steve
|