Re: v2 of seccomp filter c/r patches

2015-09-15 Thread Tycho Andersen
Hi Andy, On Tue, Sep 15, 2015 at 01:01:23PM -0700, Andy Lutomirski wrote: > On Tue, Sep 15, 2015 at 11:26 AM, Tycho Andersen > wrote: > > Hi Andy, > > > > On Tue, Sep 15, 2015 at 11:13:51AM -0700, Andy Lutomirski wrote: > >> On Tue, Sep 15, 2015 at 9:07 AM, Tycho Andersen > >> wrote: > >> > Hi A

Re: v2 of seccomp filter c/r patches

2015-09-15 Thread Andy Lutomirski
On Tue, Sep 15, 2015 at 11:26 AM, Tycho Andersen wrote: > Hi Andy, > > On Tue, Sep 15, 2015 at 11:13:51AM -0700, Andy Lutomirski wrote: >> On Tue, Sep 15, 2015 at 9:07 AM, Tycho Andersen >> wrote: >> > Hi Andy, >> > >> > On Mon, Sep 14, 2015 at 10:52:46AM -0700, Andy Lutomirski wrote: >> >> >> >>

Re: v2 of seccomp filter c/r patches

2015-09-15 Thread Tycho Andersen
Hi Andy, On Tue, Sep 15, 2015 at 11:13:51AM -0700, Andy Lutomirski wrote: > On Tue, Sep 15, 2015 at 9:07 AM, Tycho Andersen > wrote: > > Hi Andy, > > > > On Mon, Sep 14, 2015 at 10:52:46AM -0700, Andy Lutomirski wrote: > >> > >> I'm not sure I entirely like this solution... > > > > Ok. Since we a

Re: v2 of seccomp filter c/r patches

2015-09-15 Thread Andy Lutomirski
On Tue, Sep 15, 2015 at 9:07 AM, Tycho Andersen wrote: > Hi Andy, > > On Mon, Sep 14, 2015 at 10:52:46AM -0700, Andy Lutomirski wrote: >> >> I'm not sure I entirely like this solution... > > Ok. Since we also aren't going to do all the eBPF stuff now, how about > something that looks like this: >

Re: v2 of seccomp filter c/r patches

2015-09-15 Thread Tycho Andersen
Hi Andy, On Mon, Sep 14, 2015 at 10:52:46AM -0700, Andy Lutomirski wrote: > > I'm not sure I entirely like this solution... Ok. Since we also aren't going to do all the eBPF stuff now, how about something that looks like this: struct seccomp_layer { unsigned int size; unsigned int type; /* S

Re: v2 of seccomp filter c/r patches

2015-09-14 Thread Andy Lutomirski
On Sep 11, 2015 10:28 AM, "Tycho Andersen" wrote: > > On Fri, Sep 11, 2015 at 10:00:22AM -0700, Andy Lutomirski wrote: > > On Fri, Sep 11, 2015 at 9:30 AM, Andy Lutomirski > > wrote: > > > On Sep 10, 2015 5:22 PM, "Tycho Andersen" > > > wrote: > > >> > > >> Hi all, > > >> > > >> Here is v2 of

Re: v2 of seccomp filter c/r patches

2015-09-11 Thread Tycho Andersen
On Fri, Sep 11, 2015 at 10:00:22AM -0700, Andy Lutomirski wrote: > On Fri, Sep 11, 2015 at 9:30 AM, Andy Lutomirski wrote: > > On Sep 10, 2015 5:22 PM, "Tycho Andersen" > > wrote: > >> > >> Hi all, > >> > >> Here is v2 of the seccomp filter c/r set. The patch notes have individual > >> changes f

Re: v2 of seccomp filter c/r patches

2015-09-11 Thread Andy Lutomirski
On Fri, Sep 11, 2015 at 9:30 AM, Andy Lutomirski wrote: > On Sep 10, 2015 5:22 PM, "Tycho Andersen" > wrote: >> >> Hi all, >> >> Here is v2 of the seccomp filter c/r set. The patch notes have individual >> changes from the last series, but there are two points not noted: >> >> * The series still

Re: v2 of seccomp filter c/r patches

2015-09-11 Thread Andy Lutomirski
On Sep 10, 2015 5:22 PM, "Tycho Andersen" wrote: > > Hi all, > > Here is v2 of the seccomp filter c/r set. The patch notes have individual > changes from the last series, but there are two points not noted: > > * The series still does not allow us to correctly restore state for programs > that w

Re: v2 of seccomp filter c/r patches

2015-09-10 Thread Alexei Starovoitov
On Thu, Sep 10, 2015 at 06:20:57PM -0600, Tycho Andersen wrote: > Hi all, > > Here is v2 of the seccomp filter c/r set. The patch notes have individual > changes from the last series, but there are two points not noted: > > * The series still does not allow us to correctly restore state for progr

v2 of seccomp filter c/r patches

2015-09-10 Thread Tycho Andersen
Hi all, Here is v2 of the seccomp filter c/r set. The patch notes have individual changes from the last series, but there are two points not noted: * The series still does not allow us to correctly restore state for programs that will use SECCOMP_FILTER_FLAG_TSYNC in the future. Given that we w