Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756943Ab1D1QxV (ORCPT ); Thu, 28 Apr 2011 12:53:21 -0400 Received: from mail-fx0-f46.google.com ([209.85.161.46]:32858 "EHLO mail-fx0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752498Ab1D1QxU convert rfc822-to-8bit (ORCPT ); Thu, 28 Apr 2011 12:53:20 -0400 MIME-Version: 1.0 In-Reply-To: <1304008096.18763.151.camel@gandalf.stny.rr.com> References: <1303960136-14298-1-git-send-email-wad@chromium.org> <1303960136-14298-2-git-send-email-wad@chromium.org> <1304008096.18763.151.camel@gandalf.stny.rr.com> Date: Thu, 28 Apr 2011 11:53:19 -0500 Message-ID: Subject: Re: [PATCH 3/7] seccomp_filter: Enable ftrace-based system call filtering From: Will Drewry To: Steven Rostedt Cc: linux-kernel@vger.kernel.org, kees.cook@canonical.com, eparis@redhat.com, agl@chromium.org, mingo@elte.hu, jmorris@namei.org, Frederic Weisbecker , Ingo Molnar , Andrew Morton , Tejun Heo , Michal Marek , Oleg Nesterov , Roland McGrath , Peter Zijlstra , Jiri Slaby , David Howells , "Serge E. Hallyn" Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1070 Lines: 23 On Thu, Apr 28, 2011 at 11:28 AM, Steven Rostedt wrote: > On Wed, 2011-04-27 at 22:08 -0500, Will Drewry wrote: > >> The only other twist is that it is possible to delay enforcement by one >> system call by supplying a "on_next_syscall: 1" 'filter'. ?This allows >> for a launcher process to fork(), prctl(), then execve() leaving the >> launched binary in a filtered state. > > I wonder if the more "unixy" thing to do is, instead of on_next_sycall, > have "enable_on_exec". Where the user could do multiple syscalls but the > filter will not take place until an exec is made? That's what it was originally, but since ftrace syscalls doesn't wrap sys_execve on x86, I opted to just say "next syscall". But of course I can just check the _NR_execve == syscall_nr and do the right thing. Duh. thanks! -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/