PROBLEM: SECCOMP documentation outdated in some arch/*/Kconfig

PROBLEM: SECCOMP documentation outdated in some arch/*/Kconfig

[Helmut Grohne]

Hi,

I didn't find out whom to report this bug to and thus report to
linux-kernel@vger.kernel.org as described in
http://kernel.org/pub/linux/docs/lkml/reporting-bugs.html.

I'm posting from outside, so please CC me.

[1] The description about seccomp is outdated in some arch/*/Kconfig
    files.

[2] According to the source (2.6.23.14) seccomp is to be activated using
    pcrtl. It was previously activated using a file /proc/<pid>/seccomp.
    The Kconfig documentation (also displayed in menuconfig) does not
    reflect this change and is thus wrong.

[3] seccomp documentation Kconfig

[4] 2.6.23.14, seems to also apply to git head:
    http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=arch/x86/Kconfig;h=80b7ba4056dbbb566841c1e1cbef9475730fe199;hb=HEAD

[5] no oops

[6] less arch/x86_64/Kconfig
    /SECCOMP

[7] Ask me again if you really think you need information about the
    environment for a documentation bug.

Helmut

Re: PROBLEM: SECCOMP documentation outdated in some arch/*/Kconfig

[Randy Dunlap]

On Tue, 22 Jan 2008 15:41:58 +0100 Helmut Grohne wrote:

> Hi,
> 
> I didn't find out whom to report this bug to and thus report to
> linux-kernel@vger.kernel.org as described in
> http://kernel.org/pub/linux/docs/lkml/reporting-bugs.html.

Andrea cc-ed.

Helmut, would you care to make a patch that you think should be
applied to the current kernel source tree?


> I'm posting from outside, so please CC me.
> 
> [1] The description about seccomp is outdated in some arch/*/Kconfig
>     files.
> 
> [2] According to the source (2.6.23.14) seccomp is to be activated using
>     pcrtl. It was previously activated using a file /proc/<pid>/seccomp.
>     The Kconfig documentation (also displayed in menuconfig) does not
>     reflect this change and is thus wrong.
> 
> [3] seccomp documentation Kconfig
> 
> [4] 2.6.23.14, seems to also apply to git head:
>     http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=arch/x86/Kconfig;h=80b7ba4056dbbb566841c1e1cbef9475730fe199;hb=HEAD
> 
> [5] no oops
> 
> [6] less arch/x86_64/Kconfig
>     /SECCOMP
> 
> [7] Ask me again if you really think you need information about the
>     environment for a documentation bug.

---
~Randy

Re: PROBLEM: SECCOMP documentation outdated in some arch/*/Kconfig

[Andrea Arcangeli]

On Tue, Jan 22, 2008 at 04:21:56PM -0800, Randy Dunlap wrote:
> On Tue, 22 Jan 2008 15:41:58 +0100 Helmut Grohne wrote:
> 
> > Hi,
> > 
> > I didn't find out whom to report this bug to and thus report to
> > linux-kernel@vger.kernel.org as described in
> > http://kernel.org/pub/linux/docs/lkml/reporting-bugs.html.
> 
> Andrea cc-ed.
> 
> Helmut, would you care to make a patch that you think should be
> applied to the current kernel source tree?

I'd like to point out CPUShare will soon become an encrypted p2p
virtual ethernet (with mac->internet:port mapping managed by the
server and routed through the buyer node if behind nat) of KVM
machines (using -net tap,fd) so anything will run unmodified
(including non-linux guest) and it can be trivally bridged to extend
the local ethernet. This was forced because despite enormous buyer
(and obviously seller) interest, very few of the buyers are capable of
writing .c and .py software to make the required modifications to
their apps to run on CPUShare (the JtR patch for seccomp was <500lines
but it's still a way too high barrier, especially during this startup
phase). After the switch to KVM, the only requirement to buy CPU power
on CPUShare is to be able to create a livecd, something more people
should be capable of doing.

Given not everyone was happy with seccomp, this would be a good time
to speak again against it, as I wouldn't be objecting its removal (not
from a CPUShare POV at least). I'd personally like seccomp to stay and
to update the Kconfig because I think it can be useful still and it's
the most secure model.