From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758179Ab2DFV0s (ORCPT ); Fri, 6 Apr 2012 17:26:48 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:37661 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753510Ab2DFV0q (ORCPT ); Fri, 6 Apr 2012 17:26:46 -0400 Date: Fri, 6 Apr 2012 14:26:44 -0700 From: Andrew Morton To: Will Drewry Cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-arch@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com, netdev@vger.kernel.org, x86@kernel.org, arnd@arndb.de, davem@davemloft.net, hpa@zytor.com, mingo@redhat.com, oleg@redhat.com, peterz@infradead.org, rdunlap@xenotime.net, mcgrathr@chromium.org, tglx@linutronix.de, luto@mit.edu, eparis@redhat.com, serge.hallyn@canonical.com, djm@mindrot.org, scarybeasts@gmail.com, indan@nul.nu, pmoore@redhat.com, corbet@lwn.net, eric.dumazet@gmail.com, markus@chromium.org, coreyb@linux.vnet.ibm.com, keescook@chromium.org, jmorris@namei.org Subject: Re: [PATCH v17 15/15] Documentation: prctl/seccomp_filter Message-Id: <20120406142644.223ffff0.akpm@linux-foundation.org> In-Reply-To: <1333051320-30872-16-git-send-email-wad@chromium.org> References: <1333051320-30872-1-git-send-email-wad@chromium.org> <1333051320-30872-16-git-send-email-wad@chromium.org> X-Mailer: Sylpheed 3.0.2 (GTK+ 2.20.1; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 29 Mar 2012 15:02:00 -0500 Will Drewry wrote: > Documents how system call filtering using Berkeley Packet > Filter programs works and how it may be used. > Includes an example for x86 and a semi-generic > example using a macro-based code generator. > > > ... > > +Adding architecture support > +----------------------- > + > +See arch/Kconfig for the authoritative requirements. In general, if an > +architecture supports both ptrace_event and seccomp, it will be able to > +support seccomp filter with minor fixup: SIGSYS support and seccomp return > +value checking. Then it must just add CONFIG_HAVE_ARCH_SECCOMP_FILTER > +to its arch-specific Kconfig. > diff --git a/samples/Makefile b/samples/Makefile > index 2f75851..5ef08bb 100644 > --- a/samples/Makefile > +++ b/samples/Makefile Oh good, I was going to ask about that. Can we get this code into tools/testing/selftests? That way people will run it more often and it's more likely to be maintained as the code evolves.