Messages in this thread | | | Date | Wed, 09 Sep 2015 18:09:43 +0200 | From | Daniel Borkmann <> | Subject | Re: [PATCH 1/6] ebpf: add a seccomp program type |
| |
On 09/09/2015 06:07 PM, Alexei Starovoitov wrote: > On Wed, Sep 09, 2015 at 09:50:35AM -0600, Tycho Andersen wrote: [...] >> Thoughts? > > Please do not add any per-instruction hacks. None of them are > necessary. Classic had to do extra ugly checks in seccomp only > because verifier wasn't flexible enough. > If you don't want to see any BPF_CALL in seccomp, just have > empty get_func_proto() callback for BPF_PROG_TYPE_SECCOMP > and verifier will reject all calls. > Currently we have only two non-generic instrucitons > LD_ABS and LD_IND that are avaialable for sockets/TC only, > because these are legacy instructions and we had to make > exceptions for them.
Yep, +1.
| |