Re: [PATCH v10 4/4] samples: add an example of seccomp user trap

2018-12-11 Thread Kees Cook
On Tue, Dec 11, 2018 at 2:24 PM Serge E. Hallyn wrote: > > On Sun, Dec 09, 2018 at 11:24:14AM -0700, Tycho Andersen wrote: > > The idea here is just to give a demonstration of how one could safely use > > the SECCOMP_RET_USER_NOTIF feature to do mount policies. This particular > > policy is (as no

Re: [PATCH v10 4/4] samples: add an example of seccomp user trap

2018-12-11 Thread Serge E. Hallyn
On Sun, Dec 09, 2018 at 11:24:14AM -0700, Tycho Andersen wrote: > The idea here is just to give a demonstration of how one could safely use > the SECCOMP_RET_USER_NOTIF feature to do mount policies. This particular > policy is (as noted in the comment) not very interesting, but it serves to > illus

[PATCH v10 4/4] samples: add an example of seccomp user trap

2018-12-09 Thread Tycho Andersen
The idea here is just to give a demonstration of how one could safely use the SECCOMP_RET_USER_NOTIF feature to do mount policies. This particular policy is (as noted in the comment) not very interesting, but it serves to illustrate how one might apply a policy dodging the various TOCTOU issues. S