On Thursday 12 May 2011, Will Drewry wrote: > This change adds a new seccomp mode based on the work by > agl@xxxxxxxxxxxx in [1]. This new mode, "filter mode", provides a hash > table of seccomp_filter objects. When in the new mode (2), all system > calls are checked against the filters - first by system call number, > then by a filter string. If an entry exists for a given system call and > all filter predicates evaluate to true, then the task may proceed. > Otherwise, the task is killed (as per seccomp_mode == 1). I've got a question about this: Do you expect the typical usage to disallow ioctl()? Given that ioctl alone is responsible for a huge number of exploits in various drivers, while certain ioctls are immensely useful (FIONREAD, FIOASYNC, ...), do you expect to extend the mechanism to filter specific ioctl commands in the future? Arnd
