Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752336AbbFEVxI (ORCPT ); Fri, 5 Jun 2015 17:53:08 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37931 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751909AbbFEVxG (ORCPT ); Fri, 5 Jun 2015 17:53:06 -0400 Date: Fri, 5 Jun 2015 23:52:08 +0200 From: Oleg Nesterov To: Tycho Andersen Cc: linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, Kees Cook , Andy Lutomirski , Will Drewry , Roland McGrath , Pavel Emelyanov , "Serge E. Hallyn" Subject: Re: [PATCH v3] seccomp: add ptrace options for suspend/resume Message-ID: <20150605215208.GA27105@redhat.com> References: <1433539312-3999-1-git-send-email-tycho.andersen@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1433539312-3999-1-git-send-email-tycho.andersen@canonical.com> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1522 Lines: 52 Tycho, I hate myself, but I have another nit ;) again, it is not that I think you should updtate the patch, just fyi... On 06/05, Tycho Andersen wrote: > > --- a/include/linux/seccomp.h > +++ b/include/linux/seccomp.h > @@ -95,4 +95,14 @@ static inline void get_seccomp_filter(struct task_struct *tsk) > return; > } > #endif /* CONFIG_SECCOMP_FILTER */ > + > +#ifdef CONFIG_CHECKPOINT_RESTORE > +extern bool may_suspend_seccomp(void); > +#else > +static inline bool may_suspend_seccomp(void) > +{ > + return false; > +} > +#endif This looks wrong. There is no "extern may_suspend_seccomp()" if CONFIG_SECCOMP=n, kernel/seccomp.c is not compiled. So you need another ifdef(CONFIG_SECCOMP). At the same time this does not matter and you do not need the dummy "inline" version at all: > @@ -556,6 +557,15 @@ static int ptrace_setoptions(struct task_struct *child, unsigned long data) > if (data & ~(unsigned long)PTRACE_O_MASK) > return -EINVAL; > > + if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { > + if (!config_enabled(CONFIG_CHECKPOINT_RESTORE) || > + !config_enabled(CONFIG_SECCOMP)) > + return -EINVAL; > + > + if (!may_suspend_seccomp()) > + return -EPERM; gcc will optimize out may_suspend_seccomp() unless both options are enabled. Oleg. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/