On Thu, February 23, 2012 20:26, Will Drewry wrote: > Seems like there's an argument for another return code, > SECCOMP_RET_CORE, that resets/unblocks the SIGSYS handler since the > existing TRAP and KILL options seem to cover the other paths (signal > handler and do_exit). What about making SECCOMP_RET_TRAP dump core/send SIGSYS if there is no tracer with PTRACE_O_SECCOMP set? And perhaps go for a blockable SIGSYS? That way you only have KILL, ERRNO and TRAP, with the last one meaning deny, but giving someone else a chance to do something. Or is that just confusing? I don't think there should be too many return values, or else you put too much runtime policy into the filters. Sending SIGSYS is useful, but it's quite a bit less useful if user space can't handle it in a signal handler, so I don't think it's worth it to make a unblockable version. Greetings, Indan -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
