Hi Andy,
On Mon, Sep 14, 2015 at 10:52:46AM -0700, Andy Lutomirski wrote:
>
> I'm not sure I entirely like this solution...
Ok. Since we also aren't going to do all the eBPF stuff now, how about
something that looks like this:
struct seccomp_layer {
unsigned int size;
unsigned int type; /* SECCOMP_BPF_CLASSIC or SECCOMP_EBPF or ... */
bool inherited;
union {
unsigned int insn_cnt;
struct bpf_insn *insns;
};
};
with a ptrace command:
ptrace(PTRACE_SECCOMP_DUMP_LAYER, pid, i, &layer);
If we save a pointer to the current seccomp filter on fork (if there
is one), then I think the inherited flag is just,
inherited = is_ancestor(child->seccomp.filter, child->seccomp.inherited_filter)
In order to restore this (so it can be checkpointed again), we need a
command that looks like:
seccomp(SECCOMP_INHERIT_FILTER);
which sets the current and inherited filter to that of the parent
process. (Optionally we could have seccomp(SECCOMP_INHERIT_FILTER, i)
to inherit the ith filter from the parent, but we can coordinate this
via userpace so it's not strictly necessary.) So the whole c/r process
looks something like:
--- dump ---
for (i = 0; true; i++) {
ret = ptrace(PTRACE_SECCOMP_DUMP_FILTER, pid, i, &layer);
if (ret == -ESRCH)
break;
if (ret < 0)
/* real error */
/* save the filter if it's not inherited, if it is, mark the filter
* to be inherited from ppid; note that this index is walking up the
* tree following filter->prev, and the index we want to reason
* about on restore is walking down, so we should reverse the whole
* array.
*/
}
--- restore ---
if (have_inherited_filters) {
wait_for_ppid_seccomp_restore(n_inherited);
seccomp(SECCOMP_INHERIT_FILTER);
signal_done_inheriting();
}
for (i = 0; i < n_filters; i++) {
seccomp(SECCOMP_SET_MODE_FILTER, ...);
if (child_inherited_filter(i))
signal_children_filter(i);
}
I played around with an implementation of SECCOMP_INHERIT_FILTER last
night and I think I have one that might work. Thoughts?
Tycho
--
To unsubscribe from this list: send the line "unsubscribe linux-api" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
