Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752174Ab1FXUYD (ORCPT ); Fri, 24 Jun 2011 16:24:03 -0400 Received: from smtp.outflux.net ([198.145.64.163]:53341 "EHLO smtp.outflux.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751133Ab1FXUYA (ORCPT ); Fri, 24 Jun 2011 16:24:00 -0400 Date: Fri, 24 Jun 2011 13:20:15 -0700 From: Kees Cook To: Will Drewry Cc: linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, djm@mindrot.org, segoon@openwall.com, mingo@elte.hu, rostedt@goodmis.org, jmorris@namei.org, fweisbec@gmail.com, tglx@linutronix.de, scarybeasts@gmail.com, Peter Zijlstra , "Paul E. McKenney" , Andrew Morton , David Howells , Eric Paris , Borislav Petkov , Michal Marek , Mike Galbraith , "Serge E. Hallyn" , Jiri Slaby , Greg Kroah-Hartman , linux-security-module@vger.kernel.org Subject: Re: [PATCH v9 03/13] seccomp_filter: new mode with configurable syscall filters Message-ID: <20110624202015.GD32221@outflux.net> References: <1308875813-20122-1-git-send-email-wad@chromium.org> <1308875813-20122-3-git-send-email-wad@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1308875813-20122-3-git-send-email-wad@chromium.org> Organization: Canonical X-HELO: www.outflux.net Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 930 Lines: 25 Hi Will, On Thu, Jun 23, 2011 at 07:36:42PM -0500, Will Drewry wrote: > This change adds a new seccomp mode which specifies the allowed system > calls dynamically. When in the new mode (2), all system calls are > checked against process-defined filters - first by system call number, > then by a filter string. If an entry exists for a given system call and > all filter predicates evaluate to true, then the task may proceed. > Otherwise, the task is killed. > [...] > Signed-off-by: Will Drewry Thanks for continuing to work on this. I look forward to being able to use it. :) Acked-by: Kees Cook -- Kees Cook Ubuntu Security Team -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/