Re: [PATCH v2 1/3] seccomp: Add find_notification helper

2020-05-29 Thread Kees Cook
On Fri, May 29, 2020 at 05:40:38PM +, Sargun Dhillon wrote: > > > > While the comment is good, let's actually enforce this with: > > > > if (WARN_ON(!mutex_is_locked(&filter->notif_lock))) > > return NULL; > > > I don't see much use of lockdep in seccomp (well, any), but > wouldn't a str

Re: [PATCH v2 1/3] seccomp: Add find_notification helper

2020-05-29 Thread Sargun Dhillon
> > While the comment is good, let's actually enforce this with: > > if (WARN_ON(!mutex_is_locked(&filter->notif_lock))) > return NULL; > I don't see much use of lockdep in seccomp (well, any), but wouldn't a stronger statement be to use lockdep, and just have: lockdep_assert_held(&filter

Re: [PATCH v2 1/3] seccomp: Add find_notification helper

2020-05-29 Thread Christian Brauner
On Thu, May 28, 2020 at 04:08:56AM -0700, Sargun Dhillon wrote: > This adds a helper which can iterate through a seccomp_filter to > find a notification matching an ID. It removes several replicated > chunks of code. > > Signed-off-by: Sargun Dhillon > Cc: Matt Denton > Cc: Kees Cook , > Cc: Jan

Re: [PATCH v2 1/3] seccomp: Add find_notification helper

2020-05-28 Thread Kees Cook
On Thu, May 28, 2020 at 04:08:56AM -0700, Sargun Dhillon wrote: > This adds a helper which can iterate through a seccomp_filter to > find a notification matching an ID. It removes several replicated > chunks of code. Nice, yes. I was noticing this redundancy too while I was looking at notify locki

[PATCH v2 1/3] seccomp: Add find_notification helper

2020-05-28 Thread Sargun Dhillon
This adds a helper which can iterate through a seccomp_filter to find a notification matching an ID. It removes several replicated chunks of code. Signed-off-by: Sargun Dhillon Cc: Matt Denton Cc: Kees Cook , Cc: Jann Horn , Cc: Robert Sesek , Cc: Chris Palmer Cc: Christian Brauner Cc: Tycho A