lkml.org 
[lkml]   [2016]   [May]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] seccomp: plug syscall-dodging ptrace hole
On Fri, May 27, 2016 at 12:52 PM, Andy Lutomirski <luto@amacapital.net> wrote:
>> Right, I know, it's aesthetically much nicer that way, but I really
>> want to stay totally paranoid and keep seccomp absolutely first on the
>> path.
>>
>> How about this: we'll use this patch as-is for now, since I'd like to
>> be able to start getting feedback from the container-using folks ASAP,
>> and then we can redesign the 2-phase system going forward from there.
>>
>
> I think I'd rather change the ABI as few times as possible. On the
> other hand, it's still early, and I see nothing wrong with adding it
> to -next.

To get the ball rolling:

https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/log/?h=seccomp

It's incomplete, but it should be straightforward to finish it. The
only interesting bit is dealing with SECCOMP_RET_TRACE.

--Andy

\
 
 \ /
  Last update: 2016-05-27 22:41    [W:0.073 / U:1.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site