Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-30 Thread Andy Lutomirski
On Jul 29, 2014 10:57 PM, "Eric W. Biederman" wrote: > > Andy Lutomirski writes: > > > On Tue, Jul 29, 2014 at 9:08 PM, Eric W. Biederman > > wrote: > >> Andy Lutomirski writes: > >> > >>> On Mon, Jul 28, 2014 at 2:18 PM, Eric W. Biederman > >>> wrote: > Andy Lutomirski writes: > >

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-29 Thread Andy Lutomirski
On Tue, Jul 29, 2014 at 9:08 PM, Eric W. Biederman wrote: > Andy Lutomirski writes: > >> On Mon, Jul 28, 2014 at 2:18 PM, Eric W. Biederman >> wrote: >>> Andy Lutomirski writes: >>> [cc: Eric Biederman] >>> Can we do one better and add a flag to prevent any non-self pid look

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-29 Thread Eric W. Biederman
Andy Lutomirski writes: > On Mon, Jul 28, 2014 at 2:18 PM, Eric W. Biederman > wrote: >> Andy Lutomirski writes: >> >>> [cc: Eric Biederman] >>> >> >>> Can we do one better and add a flag to prevent any non-self pid >>> lookups? This might actually be easy on top of the pid namespace work >>>

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-29 Thread Andy Lutomirski
On Mon, Jul 28, 2014 at 2:18 PM, Eric W. Biederman wrote: > Andy Lutomirski writes: > >> [cc: Eric Biederman] >> > >> Can we do one better and add a flag to prevent any non-self pid >> lookups? This might actually be easy on top of the pid namespace work >> (e.g. we could change the way that fin

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-28 Thread Eric W. Biederman
Andy Lutomirski writes: > [cc: Eric Biederman] > > Can we do one better and add a flag to prevent any non-self pid > lookups? This might actually be easy on top of the pid namespace work > (e.g. we could change the way that find_task_by_vpid works). > > It's far from just being signals. There'

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-27 Thread David Drysdale
On Fri, Jul 25, 2014 at 7:32 PM, Andy Lutomirski wrote: > On Fri, Jul 25, 2014 at 11:22 AM, Julien Tinnes wrote: >> On Fri, Jul 25, 2014 at 10:38 AM, Kees Cook wrote: >>> >>> On Fri, Jul 25, 2014 at 10:18 AM, Andy Lutomirski >>> wrote: >>> > [cc: Eric Biederman] >>> > >>> > On Fri, Jul 25, 2014

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-27 Thread David Drysdale
On Fri, Jul 25, 2014 at 6:18 PM, Andy Lutomirski wrote: > [cc: Eric Biederman] > > On Fri, Jul 25, 2014 at 10:10 AM, Kees Cook wrote: >> On Fri, Jul 25, 2014 at 8:59 AM, Andy Lutomirski wrote: >>> On Jul 25, 2014 6:48 AM, "David Drysdale" wrote: Add the current thread and thread group

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-25 Thread Andy Lutomirski
On Fri, Jul 25, 2014 at 11:22 AM, Julien Tinnes wrote: > On Fri, Jul 25, 2014 at 10:38 AM, Kees Cook wrote: >> >> On Fri, Jul 25, 2014 at 10:18 AM, Andy Lutomirski >> wrote: >> > [cc: Eric Biederman] >> > >> > On Fri, Jul 25, 2014 at 10:10 AM, Kees Cook >> > wrote: >> >> >> Julien had been want

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-25 Thread Julien Tinnes
On Fri, Jul 25, 2014 at 10:38 AM, Kees Cook wrote: > On Fri, Jul 25, 2014 at 10:18 AM, Andy Lutomirski wrote: >> [cc: Eric Biederman] >> >> On Fri, Jul 25, 2014 at 10:10 AM, Kees Cook wrote: >>> Julien had been wanting something like this too (though he'd suggested >>> it via prctl): limit the

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-25 Thread Kees Cook
On Fri, Jul 25, 2014 at 10:18 AM, Andy Lutomirski wrote: > [cc: Eric Biederman] > > On Fri, Jul 25, 2014 at 10:10 AM, Kees Cook wrote: >> On Fri, Jul 25, 2014 at 8:59 AM, Andy Lutomirski wrote: >>> On Jul 25, 2014 6:48 AM, "David Drysdale" wrote: Add the current thread and thread grou

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-25 Thread Andy Lutomirski
[cc: Eric Biederman] On Fri, Jul 25, 2014 at 10:10 AM, Kees Cook wrote: > On Fri, Jul 25, 2014 at 8:59 AM, Andy Lutomirski wrote: >> On Jul 25, 2014 6:48 AM, "David Drysdale" wrote: >>> >>> Add the current thread and thread group IDs into the data >>> available for seccomp-bpf programs to work

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-25 Thread Kees Cook
On Fri, Jul 25, 2014 at 8:59 AM, Andy Lutomirski wrote: > On Jul 25, 2014 6:48 AM, "David Drysdale" wrote: >> >> Add the current thread and thread group IDs into the data >> available for seccomp-bpf programs to work on. This allows >> installation of filters that police syscalls based on thread

Re: [PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-25 Thread Andy Lutomirski
On Jul 25, 2014 6:48 AM, "David Drysdale" wrote: > > Add the current thread and thread group IDs into the data > available for seccomp-bpf programs to work on. This allows > installation of filters that police syscalls based on thread > or process ID, e.g. tgkill(2)/kill(2)/prctl(2). > > Signed-o

[PATCH 11/11] seccomp: Add tgid and tid into seccomp_data

2014-07-25 Thread David Drysdale
Add the current thread and thread group IDs into the data available for seccomp-bpf programs to work on. This allows installation of filters that police syscalls based on thread or process ID, e.g. tgkill(2)/kill(2)/prctl(2). Signed-off-by: David Drysdale --- include/uapi/linux/seccomp.h | 10 +