Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756205AbbFBJg0 (ORCPT ); Tue, 2 Jun 2015 05:36:26 -0400 Received: from mail-lb0-f182.google.com ([209.85.217.182]:34242 "EHLO mail-lb0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752923AbbFBJgS (ORCPT ); Tue, 2 Jun 2015 05:36:18 -0400 MIME-Version: 1.0 In-Reply-To: <1433186918-9626-1-git-send-email-tycho.andersen@canonical.com> References: <1433186918-9626-1-git-send-email-tycho.andersen@canonical.com> Date: Tue, 2 Jun 2015 12:36:16 +0300 Message-ID: Subject: Re: [PATCH] seccomp: add ptrace commands for suspend/resume From: Andrey Wagin To: Tycho Andersen Cc: LKML , linux-api@vger.kernel.org, Kees Cook , Andy Lutomirski , Will Drewry , Roland McGrath , Oleg Nesterov , Pavel Emelyanov , "Serge E. Hallyn" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1148 Lines: 25 2015-06-01 22:28 GMT+03:00 Tycho Andersen : > This patch is the first step in enabling checkpoint/restore of processes > with seccomp enabled. > > One of the things CRIU does while dumping tasks is inject code into them > via ptrace to collect information that is only available to the process > itself. However, if we are in a seccomp mode where these processes are > prohibited from making these syscalls, then what CRIU does kills the task. > > This patch adds a new ptrace command, PTRACE_SUSPEND_SECCOMP that enables a > task from the init user namespace which has CAP_SYS_ADMIN to disable (and > re-enable) seccomp filters for another task so that they can be > successfully dumped (and restored). Do we need to re-enable seccomp if a tracer detaches unexpectedly. CRIU can be killed and we should try to not affect the task state even in this case. Thanks, Andrew -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/