[lkml]   [2011]   [May]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH 3/7] seccomp_filter: Enable ftrace-based system call filtering
    On 04/28/2011 06:08 AM, Will Drewry wrote:
    > This change adds a new seccomp mode based on the work by
    > This mode comes with a bitmask of NR_syscalls size and
    > an optional linked list of seccomp_filter objects. When in mode 2, all
    > system calls are first checked against the bitmask to determine if they
    > are allowed or denied. If allowed, the list of filters is checked for
    > the given syscall number. If all filter predicates for the system call
    > match or the system call was allowed without restriction, the process
    > continues. Otherwise, it is killed and a KERN_INFO notification is
    > posted.
    > The filter language itself is provided by the ftrace filter engine.
    > Related patches tweak to the perf filter trace and free allow the calls
    > to be shared. Filters inherit their understanding of types and arguments
    > for each system call from the CONFIG_FTRACE_SYSCALLS subsystem which
    > predefines this information in syscall_metadata associated enter_event
    > (and exit_event) structures.
    > The result is that a process may reduce its available interfaces to
    > the kernel through prctl() without knowing the appropriate system call
    > number a priori and with the flexibility of filtering based on
    > register-stored arguments. (String checks suffer from TOCTOU issues and
    > should be left to LSMs to provide policy for! Don't get greedy :)

    This is potentially very useful for qemu/kvm.

    error compiling committee.c: too many arguments to function

     \ /
      Last update: 2011-05-03 10:43    [W:0.019 / U:82.388 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site