Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
In-Reply-To: <1530189936-25780-8-git-send-email-nmanthey@amazon.de>
References: <ef0fe0ef-3620-3628-2a7e-c8b73e466a21@amazon.de>
 <1530189936-25780-1-git-send-email-nmanthey@amazon.de> <1530189936-25780-8-git-send-email-nmanthey@amazon.de>
From:   Kees Cook <keescook@chromium.org>
Date:   Thu, 28 Jun 2018 12:02:55 -0700
Message-ID: <CAGXu5jJBvkxpnZS31hJuUo-5vTes=mLeoM=28HXD+UfzKYsv-w@mail.gmail.com>
Subject: Re: [less-CONFIG_NET v2 7/8] seccomp: drop CONFIG_NET
To:     Norbert Manthey <nmanthey@amazon.de>
Cc:     LKML <linux-kernel@vger.kernel.org>,
        Masahiro Yamada <yamada.masahiro@socionext.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Nicholas Piggin <npiggin@gmail.com>,
        Arnd Bergmann <arnd@arndb.de>, Josef Bacik <jbacik@fb.com>,
        Masami Hiramatsu <mhiramat@kernel.org>,
        Deepa Dinamani <deepa.kernel@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Jun 28, 2018 at 5:45 AM, Norbert Manthey <nmanthey@amazon.de> wrote:
> With the goal of dropping CONFIG_NET, we have to drop the dependency
> in the configuration management. Since SECCOMP_FILTER also requires
> BPF functionality, which is usually activated by CONFIG_NET, imply
> BPF from SECCOMP_FILTER directly.

Nit: "select" not "imply"

> In case both CONFIG_NET and CONFIG_SECCOMP_FILTER are activated, BPF
> will be activated as well, so this additional dependency does not
> destroy original builds.
>
> Signed-off-by: Norbert Manthey <nmanthey@amazon.de>

Otherwise, sure. As long as this still compiles and runs, it looks
fine to me! :)

-Kees

> ---
>  arch/Kconfig | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/Kconfig b/arch/Kconfig
> index 1aa5906..8cfb634 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -397,7 +397,8 @@ config HAVE_ARCH_SECCOMP_FILTER
>
>  config SECCOMP_FILTER
>         def_bool y
> -       depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET
> +       depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP
> +       select BPF
>         help
>           Enable tasks to build secure computing environments defined
>           in terms of Berkeley Packet Filter programs which implement
> --
> 2.7.4
>
> Amazon Development Center Germany GmbH
> Berlin - Dresden - Aachen
> main office: Krausenstr. 38, 10117 Berlin
> Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
> Ust-ID: DE289237879
> Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
>


-- 
Kees Cook
Pixel Security