Messages in this thread | | | Date | Tue, 30 Oct 2018 11:21:43 -0600 | From | Tycho Andersen <> | Subject | Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace |
| |
On Tue, Oct 30, 2018 at 05:39:26PM +0100, Oleg Nesterov wrote: > On 10/30, Oleg Nesterov wrote: > > > > On 10/30, Tycho Andersen wrote: > > > > > > @@ -828,6 +823,11 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, > > > */ > > > rmb(); > > > > > > + if (!sd) { > > > + populate_seccomp_data(&sd_local); > > > + sd = &sd_local; > > > + } > > > + > > > > To me it would be more clean to remove the "if (!sd)" check, case(SECCOMP_RET_TRACE) > > in __seccomp_filter() can simply do populate_seccomp_data(&sd_local) unconditionally > > and pass &sd_local to __seccomp_filter(). > > Ah, please ignore, emulate_vsyscall() does secure_computing(NULL). > > Btw. why __seccomp_filter() doesn't return a boolean? > > Or at least, why can't case(SECCOMP_RET_TRACE) simply do > > return __seccomp_filter(this_syscall, NULL, true); > > ?
Yeah, at least the second one definitely makes sense. I can add that as a patch in the next version of this series unless Kees does it before.
Thanks for your help, Oleg!
Tycho
| |