Re: [PATCH v9 3/4] seccomp: add a return code to trap to userspace

2018-12-03 Thread Serge E. Hallyn
On Mon, Dec 03, 2018 at 08:52:11AM -0700, Tycho Andersen wrote: > On Sun, Dec 02, 2018 at 11:26:50PM -0600, Serge E. Hallyn wrote: > > On Sun, Dec 02, 2018 at 08:28:26PM -0700, Tycho Andersen wrote: > > > +struct seccomp_knotif { > > > + /* The struct pid of the task whose filter triggered the noti

Re: [PATCH v9 3/4] seccomp: add a return code to trap to userspace

2018-12-03 Thread Tycho Andersen
On Sun, Dec 02, 2018 at 11:26:50PM -0600, Serge E. Hallyn wrote: > On Sun, Dec 02, 2018 at 08:28:26PM -0700, Tycho Andersen wrote: > > +struct seccomp_knotif { > > + /* The struct pid of the task whose filter triggered the notification */ > > + struct task_struct *task; > > + > > + /* The "co

Re: [PATCH v9 3/4] seccomp: add a return code to trap to userspace

2018-12-02 Thread Serge E. Hallyn
On Sun, Dec 02, 2018 at 08:28:26PM -0700, Tycho Andersen wrote: > This patch introduces a means for syscalls matched in seccomp to notify > some other task that a particular filter has been triggered. > > The motivation for this is primarily for use with containers. For example, > if a container d

[PATCH v9 3/4] seccomp: add a return code to trap to userspace

2018-12-02 Thread Tycho Andersen
This patch introduces a means for syscalls matched in seccomp to notify some other task that a particular filter has been triggered. The motivation for this is primarily for use with containers. For example, if a container does an init_module(), we obviously don't want to load this untrusted code,