lkml.org 
[lkml]   [2011]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v4 03/13] seccomp_filters: new mode with configurable syscall filters
From
On Fri, Jun 3, 2011 at 4:34 PM, Will Drewry <wad@chromium.org> wrote:
> (Any thoughts specifically on the mutex use would be greatly appreciated!)
>
> This change adds a new seccomp mode which specifies the allowed system
> calls dynamically.

One thing to consider (not sure if it's been discussed, but I think
not) is whether some of the LSMs should hook this.

Notably, it looks like SELinux doesn't have an access vector for prctl
at all now; it doesn't hook task_prctl from what I see, and so we fall
back to cap_task_prctl. While I know the idea of restricting a
process' ability to enter seccomp is a bit perverse, we should
probably at least allow mandatory controls. James?


\
 
 \ /
  Last update: 2011-06-04 00:19    [W:0.177 / U:1.592 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site