1 Feb 02:36
Re: [PATCH v5 2/3] seccomp_filters: system call filtering using BPF
Indan Zupancic <indan <at> nul.nu>
2012-02-01 01:36:17 GMT
2012-02-01 01:36:17 GMT
On Tue, January 31, 2012 12:04, Will Drewry wrote: > On Mon, Jan 30, 2012 at 7:42 PM, Indan Zupancic <indan <at> nul.nu> wrote: >>> I vote for: >>> >>> 3. Add tracehook support to all archs. > > I don't see these #3 as mutually exclusive :) They are if you really add tracehook support to all archs.(Continue reading)> tracehook requires: > - task_pt_regs() in asm/processor.h or asm/ptrace.h > - arch_has_single_step() if there is hardware single-step support > - arch_has_block_step() if there is hardware block-step support > - asm/syscall.h supplying asm-generic/syscall.h interface > - linux/regset.h user_regset interfaces > - CORE_DUMP_USE_REGSET #define'd in linux/elf.h > -TIF_SYSCALL_TRACE calls tracehook_report_syscall_{entry,exit} > - TIF_NOTIFY_RESUME calls tracehook_notify_resume() > - signal delivery calls tracehook_signal_handler() Okay, that's a bit fuzzier than I expected. I suppose the archs implement some of that in another way currently? >>> Maybe not all archs, but at least some more. That way, every time someone >>> adds something tracehook specific, more archs support it. > > Well the other arch I want this on specifically for my purposes is > arm, but someone recently posted a partial asm/syscall.h for arm, but > I didn't see that one go anywhere just yet. (I know syscall_get_nr
> tracehook requires:
> - task_pt_regs() in asm/processor.h or asm/ptrace.h
> - arch_has_single_step() if there is hardware single-step support
> - arch_has_block_step() if there is hardware block-step support
> - asm/syscall.h supplying asm-generic/syscall.h interface
> - linux/regset.h user_regset interfaces
> - CORE_DUMP_USE_REGSET #define'd in linux/elf.h
> -TIF_SYSCALL_TRACE calls tracehook_report_syscall_{entry,exit}
> - TIF_NOTIFY_RESUME calls tracehook_notify_resume()
> - signal delivery calls tracehook_signal_handler()
Okay, that's a bit fuzzier than I expected. I suppose the archs implement
some of that in another way currently?
>>> Maybe not all archs, but at least some more. That way, every time someone
>>> adds something tracehook specific, more archs support it.
>
> Well the other arch I want this on specifically for my purposes is
> arm, but someone recently posted a partial asm/syscall.h for arm, but
> I didn't see that one go anywhere just yet. (I know syscall_get_nr
RSS Feed