Messages in this thread | | | Date | Thu, 24 May 2012 16:56:50 -0700 | From | "H. Peter Anvin" <> | Subject | Re: [RFC PATCH 0/3] move the secure_computing call |
| |
On 05/24/2012 04:43 PM, Andrew Lutomirski wrote: > > IMO the behavior should change. Alternatively, a post-ptrace syscall > should have to pass the *tracer's* seccomp filter, but that seems > overcomplicated and confusing. > > OTOH, allowing ptrace in a seccomp filter is asking for trouble anyway > -- if you can ptrace something outside the sandbox, you've escaped. >
This is my suggestion: if there is demand, make it possible to install a *second* seccomp filter program which is run on the result of the ptrace. I.e.:
Untraced: process -> seccomp1 -> kernel
Traced: process -> seccomp1 -> ptrace -> seccomp2 -> kernel
This is something we could add later if there is demand.
-hpa
| |