[PATCH v3 0/2] seccomp: pass uretprobe system call through seccomp

[Eyal Birger <eyal.birger@gmail.com>]

uretprobe(2) is an performance enhancement system call added to improve
uretprobes on x86_64.

Confinement environments such as Docker are not aware of this new system
call and kill confined processes when uretprobes are attached to them.

Since uretprobe is a "kernel implementation detail" system call which is
not used by userspace application code directly, pass this system call
through seccomp without forcing existing userspace confinement environments
to be changed.

To: Kees Cook <kees@kernel.org>
To: Andy Lutomirski <luto@amacapital.net>
To: Will Drewry <wad@chromium.org>
To: Oleg Nesterov <oleg@redhat.com>
To: Masami Hiramatsu (Google) <mhiramat@kernel.org>
To: Jiri Olsa <jolsa@kernel.org>
To: Andrii Nakryiko <andrii@kernel.org>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>

Eyal Birger (2):
  seccomp: passthrough uretprobe systemcall without filtering
  selftests/seccomp: validate uretprobe syscall passes through seccomp

 kernel/seccomp.c                              |  24 ++-
 tools/testing/selftests/seccomp/seccomp_bpf.c | 195 ++++++++++++++++++
 2 files changed, 216 insertions(+), 3 deletions(-)

-- 
2.43.0