Several months ago at Linux Plumber's, we had a discussion about adding a feature to seccomp which would allow seccomp to trigger a notification for some other process. Here's a draft of that feature. Patch 1 contains the bulk of it, patches 2 & 3 offer an alternative way to acquire the fd that receives notifications via ptrace (the method in patch 1 poses some problems). Other suggestions for how to acquire one of these fds would be welcome. Take a close look at the synchronization. I think I've got it right, but I probably don't :) Thanks! Tycho Andersen (3): seccomp: add a return code to trap to userspace seccomp: hoist out filter resolving logic seccomp: add a way to get a listener fd from ptrace arch/Kconfig | 7 + include/linux/seccomp.h | 14 +- include/uapi/linux/ptrace.h | 1 + include/uapi/linux/seccomp.h | 18 +- kernel/ptrace.c | 4 + kernel/seccomp.c | 467 ++++++++++++++++++++++++-- tools/testing/selftests/seccomp/seccomp_bpf.c | 180 +++++++++- 7 files changed, 653 insertions(+), 38 deletions(-) -- 2.14.1 _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
