Messages in this thread | | | From | Andy Lutomirski <> | Date | Fri, 27 May 2016 13:14:37 -0700 | Subject | Re: [PATCH] seccomp: plug syscall-dodging ptrace hole |
| |
On Fri, May 27, 2016 at 12:52 PM, Andy Lutomirski <luto@amacapital.net> wrote: >> Right, I know, it's aesthetically much nicer that way, but I really >> want to stay totally paranoid and keep seccomp absolutely first on the >> path. >> >> How about this: we'll use this patch as-is for now, since I'd like to >> be able to start getting feedback from the container-using folks ASAP, >> and then we can redesign the 2-phase system going forward from there. >> > > I think I'd rather change the ABI as few times as possible. On the > other hand, it's still early, and I see nothing wrong with adding it > to -next.
To get the ball rolling:
https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/log/?h=seccomp
It's incomplete, but it should be straightforward to finish it. The only interesting bit is dealing with SECCOMP_RET_TRACE.
--Andy
| |