[RFC PATCH 1/2] seccomp: introduce seccomp_nack_syscall() helper

Oleg Nesterov
2026-04-19T15:53:31Z

To factor out the code and simplify the next change

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
---
kernel/seccomp.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 066909393c38..cb8dd78791cd 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1256,6 +1256,14 @@ static int seccomp_do_user_notification(int this_syscall,
return -1;
}

+static void seccomp_nack_syscall(int this_syscall, int data, bool force_coredump)
+{
+ /* Show the handler or coredump the original registers. */
+ syscall_rollback(current, current_pt_regs());
+ /* Let the filter pass back 16 bits of data. */
+ force_sig_seccomp(this_syscall, data, force_coredump);
+}
+
static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
{
u32 filter_ret, action;
@@ -1285,10 +1293,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
goto skip;

case SECCOMP_RET_TRAP:
- /* Show the handler the original registers. */
- syscall_rollback(current, current_pt_regs());
- /* Let the filter pass back 16 bits of data. */
- force_sig_seccomp(this_syscall, data, false);
+ seccomp_nack_syscall(this_syscall, data, false);
goto skip;

case SECCOMP_RET_TRACE:
@@ -1360,10 +1365,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
/* Dump core only if this is the last remaining thread. */
if (action != SECCOMP_RET_KILL_THREAD ||
(atomic_read(&current->signal->live) == 1)) {
- /* Show the original registers in the dump. */
- syscall_rollback(current, current_pt_regs());
- /* Trigger a coredump with SIGSYS */
- force_sig_seccomp(this_syscall, data, true);
+ seccomp_nack_syscall(this_syscall, data, true);
} else {
do_exit(SIGSYS);
}
--
2.52.0