Messages in this thread | | | Date | Thu, 28 Apr 2011 11:53:19 -0500 | Subject | Re: [PATCH 3/7] seccomp_filter: Enable ftrace-based system call filtering | From | Will Drewry <> |
| |
On Thu, Apr 28, 2011 at 11:28 AM, Steven Rostedt <rostedt@goodmis.org> wrote: > On Wed, 2011-04-27 at 22:08 -0500, Will Drewry wrote: > >> The only other twist is that it is possible to delay enforcement by one >> system call by supplying a "on_next_syscall: 1" 'filter'. This allows >> for a launcher process to fork(), prctl(), then execve() leaving the >> launched binary in a filtered state. > > I wonder if the more "unixy" thing to do is, instead of on_next_sycall, > have "enable_on_exec". Where the user could do multiple syscalls but the > filter will not take place until an exec is made?
That's what it was originally, but since ftrace syscalls doesn't wrap sys_execve on x86, I opted to just say "next syscall". But of course I can just check the _NR_execve == syscall_nr and do the right thing. Duh.
thanks! -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |