lkml.org 
[lkml]   [2012]   [Dec]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 2/3] Documentation: SECCOMP_RET_INFO return value
Date
Adds documentation describing the SECCOMP_RET_INFO return value.

Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com>
---
Documentation/prctl/seccomp_filter.txt | 7 +++++++
1 file changed, 7 insertions(+)

diff --git a/Documentation/prctl/seccomp_filter.txt b/Documentation/prctl/seccomp_filter.txt
index 1e469ef..ffddf9f 100644
--- a/Documentation/prctl/seccomp_filter.txt
+++ b/Documentation/prctl/seccomp_filter.txt
@@ -49,6 +49,7 @@ CONFIG_HAVE_ARCH_SECCOMP_FILTER, then filters may be added as below:
PR_SET_SECCOMP:
Now takes an additional argument which specifies a new filter
using a BPF program.
+
The BPF program will be executed over struct seccomp_data
reflecting the system call number, arguments, and other
metadata. The BPF program must then return one of the
@@ -138,6 +139,12 @@ SECCOMP_RET_TRACE:
allow use of ptrace, even of other sandboxed processes, without
extreme care; ptracers can use this mechanism to escape.)

+SECCOMP_RET_INFO:
+ Results in a rate-limited informational kernel message that
+ includes the system call number, and the system call is
+ executed. The message format is:
+ "seccomp: syscall=x", where x is the system call number.
+
SECCOMP_RET_ALLOW:
Results in the system call being executed.

--
1.7.11.7


\
 
 \ /
  Last update: 2012-12-18 23:01    [W:0.036 / U:0.404 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site