Re: [kernel-hardening] Re: [RFC PATCH 1/1] seccomp: provide information about the previous syscall

From	Paul Moore <paul@paul-moore.com>
Newsgroups	linux.kernel
Subject	Re: [kernel-hardening] Re: [RFC PATCH 1/1] seccomp: provide information about the previous syscall
Date	2016-01-22 23:20 +0100
Message-ID	<qTSdJ-1SX-31@gated-at.bofh.it> (permalink)
References	<qTDHH-e4-1@gated-at.bofh.it> <qTDHH-e4-15@gated-at.bofh.it> <qTNQK-7gK-17@gated-at.bofh.it> <qTRrk-1iu-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, Jan 22, 2016 at 4:23 PM, Kees Cook <keescook@chromium.org> wrote:
> Yeah, and if we break abi, we need to add further sanity checking to
> the parser to determine which "version" of seccomp_data we need. I'm
> not convinced that there is enough utility here to break ABI.

PLEASE do not break the seccomp ABI for this alone ... I'm still
trying to sort out the well intentioned, but extremely annoying
direct-wired x86 socket syscalls in 4.4 for libseccomp, I don't want
to have to deal with another big change for at least a month or two ;)

> (Though if we do, I'd like to add tid to the seccomp_data, which has
> been requested in the past to make some pid-based arg checks easier to
> do.)

Agreed, if we break anything, please add this.

-- 
paul moore
www.paul-moore.com

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[RFC PATCH 0/1] Adding previous syscall context to seccomp Daniel Sangorrin <daniel.sangorrin@toshiba.co.jp> - 2016-01-22 07:50 +0100
  [RFC PATCH 1/1] seccomp: provide information about the previous syscall Daniel Sangorrin <daniel.sangorrin@toshiba.co.jp> - 2016-01-22 07:50 +0100
    Re: [kernel-hardening] [RFC PATCH 1/1] seccomp: provide information  about the previous syscall Jann Horn <jann@thejh.net> - 2016-01-22 11:50 +0100
      Re: [kernel-hardening] [RFC PATCH 1/1] seccomp: provide information  about the previous syscall Andy Lutomirski <luto@amacapital.net> - 2016-01-22 18:20 +0100
      RE: [kernel-hardening] [RFC PATCH 1/1] seccomp: provide information about the previous syscall "Daniel Sangorrin" <daniel.sangorrin@toshiba.co.jp> - 2016-01-25 04:50 +0100
    Re: [RFC PATCH 1/1] seccomp: provide information about the previous  syscall Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-01-22 18:40 +0100
      Re: [RFC PATCH 1/1] seccomp: provide information about the previous syscall Kees Cook <keescook@chromium.org> - 2016-01-22 22:30 +0100
        Re: [kernel-hardening] Re: [RFC PATCH 1/1] seccomp: provide  information about the previous syscall Paul Moore <paul@paul-moore.com> - 2016-01-22 23:20 +0100

csiph-web