From: Oleg Nesterov <oleg@redhat.com>
To: Andy Lutomirski <luto@kernel.org>, Kees Cook <kees@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
Thomas Gleixner <tglx@kernel.org>, Will Drewry <wad@chromium.org>
Cc: Kusaram Devineni <kusaram@devineni.in>,
Max Ver <dudududumaxver@gmail.com>,
linux-kernel@vger.kernel.org
Subject: [RFC PATCH 1/2] seccomp: introduce seccomp_nack_syscall() helper
Date: Tue, 14 Apr 2026 18:48:14 +0200 [thread overview]
Message-ID: <ad5vztrjvqD0wOCf@redhat.com> (raw)
In-Reply-To: <ad5voOrbqayQBgNk@redhat.com>
To factor out the code and simplify the next change
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
---
kernel/seccomp.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 066909393c38..cb8dd78791cd 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1256,6 +1256,14 @@ static int seccomp_do_user_notification(int this_syscall,
return -1;
}
+static void seccomp_nack_syscall(int this_syscall, int data, bool force_coredump)
+{
+ /* Show the handler or coredump the original registers. */
+ syscall_rollback(current, current_pt_regs());
+ /* Let the filter pass back 16 bits of data. */
+ force_sig_seccomp(this_syscall, data, force_coredump);
+}
+
static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
{
u32 filter_ret, action;
@@ -1285,10 +1293,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
goto skip;
case SECCOMP_RET_TRAP:
- /* Show the handler the original registers. */
- syscall_rollback(current, current_pt_regs());
- /* Let the filter pass back 16 bits of data. */
- force_sig_seccomp(this_syscall, data, false);
+ seccomp_nack_syscall(this_syscall, data, false);
goto skip;
case SECCOMP_RET_TRACE:
@@ -1360,10 +1365,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
/* Dump core only if this is the last remaining thread. */
if (action != SECCOMP_RET_KILL_THREAD ||
(atomic_read(¤t->signal->live) == 1)) {
- /* Show the original registers in the dump. */
- syscall_rollback(current, current_pt_regs());
- /* Trigger a coredump with SIGSYS */
- force_sig_seccomp(this_syscall, data, true);
+ seccomp_nack_syscall(this_syscall, data, true);
} else {
do_exit(SIGSYS);
}
--
2.52.0
next prev parent reply other threads:[~2026-04-14 16:48 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-14 16:47 [RFC PATCH 0/2] seccomp: defer syscall_rollback() to get_signal() Oleg Nesterov
2026-04-14 16:48 ` Oleg Nesterov [this message]
2026-04-14 16:48 ` [RFC PATCH 2/2] " Oleg Nesterov
2026-04-14 17:27 ` Kees Cook
2026-04-14 17:41 ` Oleg Nesterov
2026-04-15 15:50 ` Kees Cook
2026-04-15 16:08 ` Oleg Nesterov
2026-04-15 10:44 ` [RFC PATCH 0/2] " Oleg Nesterov
2026-04-15 16:07 ` Kees Cook
2026-04-15 19:21 ` Kees Cook
2026-04-16 14:07 ` Oleg Nesterov
-- strict thread matches above, loose matches on Subject: below --
2026-04-19 15:52 [RFC PATCH 0/2] seccomp: drop syscall exit events for rejected syscalls Oleg Nesterov
2026-04-19 15:53 ` [RFC PATCH 1/2] seccomp: introduce seccomp_nack_syscall() helper Oleg Nesterov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ad5vztrjvqD0wOCf@redhat.com \
--to=oleg@redhat.com \
--cc=dudududumaxver@gmail.com \
--cc=kees@kernel.org \
--cc=kusaram@devineni.in \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=peterz@infradead.org \
--cc=tglx@kernel.org \
--cc=wad@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.