From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrey Wagin Subject: Re: [PATCH] seccomp: add ptrace commands for suspend/resume Date: Tue, 2 Jun 2015 12:36:16 +0300 Message-ID: References: <1433186918-9626-1-git-send-email-tycho.andersen@canonical.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Return-path: In-Reply-To: <1433186918-9626-1-git-send-email-tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Tycho Andersen Cc: LKML , linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Kees Cook , Andy Lutomirski , Will Drewry , Roland McGrath , Oleg Nesterov , Pavel Emelyanov , "Serge E. Hallyn" List-Id: linux-api@vger.kernel.org 2015-06-01 22:28 GMT+03:00 Tycho Andersen : > This patch is the first step in enabling checkpoint/restore of processes > with seccomp enabled. > > One of the things CRIU does while dumping tasks is inject code into them > via ptrace to collect information that is only available to the process > itself. However, if we are in a seccomp mode where these processes are > prohibited from making these syscalls, then what CRIU does kills the task. > > This patch adds a new ptrace command, PTRACE_SUSPEND_SECCOMP that enables a > task from the init user namespace which has CAP_SYS_ADMIN to disable (and > re-enable) seccomp filters for another task so that they can be > successfully dumped (and restored). Do we need to re-enable seccomp if a tracer detaches unexpectedly. CRIU can be killed and we should try to not affect the task state even in this case. Thanks, Andrew