Re: [PATCH v3 0/4] Add seccomp notifier ioctl that enables adding fds

On Wed, Jun 03, 2020 at 04:56:59PM -0700, Sargun Dhillon wrote: > On Wed, Jun 3, 2020 at 4:42 PM Kees Cook wrote: > > > > On Tue, Jun 02, 2020 at 06:10:40PM -0700, Sargun Dhillon wrote: > > > Sargun Dhillon (4): > > > fs, net: Standardize on file_receive helper to move fds across > > >

Re: [PATCH v3 0/4] Add seccomp notifier ioctl that enables adding fds

On Wed, Jun 3, 2020 at 4:42 PM Kees Cook wrote: > > On Tue, Jun 02, 2020 at 06:10:40PM -0700, Sargun Dhillon wrote: > > Sargun Dhillon (4): > > fs, net: Standardize on file_receive helper to move fds across > > processes > > pid: Use file_receive helper to copy FDs > > The fixes (that

Re: [PATCH v3 0/4] Add seccomp notifier ioctl that enables adding fds

On Tue, Jun 02, 2020 at 06:10:40PM -0700, Sargun Dhillon wrote: > Sargun Dhillon (4): > fs, net: Standardize on file_receive helper to move fds across > processes > pid: Use file_receive helper to copy FDs The fixes (that should add open-coded cgroups stuff) should be separate patches so

Re: [PATCH v3 0/4] Add seccomp notifier ioctl that enables adding fds

Thanks for working on this, Sargun! I'll briefly interrupt the code review to explain why this is an important enhancement for our application. I’m posting this message on behalf of the Chromium project, which powers Google Chrome and several other open-source browsers (Edge, Brave, Yandex

[PATCH v3 0/4] Add seccomp notifier ioctl that enables adding fds

This adds the capability for seccomp notifier listeners to add file descriptors in response to a seccomp notification. This is useful for syscalls in which the previous capabilities were not sufficient. The current mechanism works well for syscalls that either have side effects that are system /