Messages in this thread | | | Date | Thu, 16 Feb 2012 17:10:25 -0800 | From | "H. Peter Anvin" <> | Subject | Re: [PATCH v8 3/8] seccomp: add system call filtering using BPF |
| |
On 02/16/2012 04:51 PM, Andrew Lutomirski wrote: > > IMO the best solution is to have the One True Seccomp Filter Compiler > (tm). It would handle multiple namespaces, cross-arch differences, > and such, and it would do it correctly. It could live in the kernel > tree. > > Without something like that or an incredible amount of special care, > actual portability is probably a pipe dream. > > --Andy >
Seconded!
-hpa
-- H. Peter Anvin, Intel Open Source Technology Center I work for Intel. I don't speak on their behalf.
| |