Re: [kernel-hardening] Re: [PATCH 1/2] security, perf: allow further restriction of perf_event_open

2016-08-02 Thread Jeffrey Vander Stoep
Far from trying to kill perf, we want (and require) perf to be available to developers on Android. All that this patch enables us to do is gate it behind developer settings - just like we do with other developer targeted features. (apologies for the dup, bounced due to non-plaintext) On Tue, Aug

Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further restriction of perf_event_open

2016-06-04 Thread Jeffrey Vander Stoep
Acked-by: Jeff Vander Stoep In addition to Debian, this patch has been merged into AOSP and is a requirement for Android: https://android-review.googlesource.com/#/q/topic:CONFIG_SECURITY_PERF_EVENTS_RESTRICT On Wed, Apr 13, 2016 at 9:12 AM, Kees Cook wrote: > On Mon, Jan 11, 2016 at 7:23 AM, B

Re: [RFC][PATCH] seccomp: add SECCOMP_RET_ACK for non-fatal SIGSYS

2016-01-28 Thread Jeffrey Vander Stoep
Thanks! This is just what I need. What are the drawbacks to returning the sigsys before executing the system call? Otherwise this loses the benefit of properly reporting registers for argument inspection. How about SECCOMP_RET_PERMISSIVE? Describes the application rather than the implementation.