lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <7dc27063cc38b4b5a0d800ee16c1aa2a89953533.1405992946.git.luto@amacapital.net> Date: Mon, 21 Jul 2014 18:49:17 -0700 From: Andy Lutomirski <luto@...capital.net> To: linux-kernel@...r.kernel.org, Kees Cook <keescook@...omium.org>, Will Drewry <wad@...omium.org> Cc: Oleg Nesterov <oleg@...hat.com>, x86@...nel.org, linux-arm-kernel@...ts.infradead.org, linux-mips@...ux-mips.org, linux-arch@...r.kernel.org, linux-security-module@...r.kernel.org, Alexei Starovoitov <ast@...mgrid.com>, hpa@...or.com, Andy Lutomirski <luto@...capital.net> Subject: [PATCH v3 4/8] seccomp: Document two-phase seccomp and arch-provided seccomp_data The description of how archs should implement seccomp filters was still strictly correct, but it failed to describe the newly available optimizations. Signed-off-by: Andy Lutomirski <luto@...capital.net> --- arch/Kconfig | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/arch/Kconfig b/arch/Kconfig index 0eae9df..05d7a8a 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -323,6 +323,17 @@ config HAVE_ARCH_SECCOMP_FILTER results in the system call being skipped immediately. - seccomp syscall wired up + For best performance, an arch should use seccomp_phase1 and + seccomp_phase2 directly. It should call seccomp_phase1 for all + syscalls if TIF_SECCOMP is set, but seccomp_phase1 does not + need to be called from a ptrace-safe context. It must then + call seccomp_phase2 if seccomp_phase1 returns anything other + than SECCOMP_PHASE1_OK or SECCOMP_PHASE1_SKIP. + + As an additional optimization, an arch may provide seccomp_data + directly to seccomp_phase1; this avoids multiple calls + to the syscall_xyz helpers for every syscall. + config SECCOMP_FILTER def_bool y depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET -- 1.9.3 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists