From: Cong Wang <[email protected]> Sandlock is an unprivileged Linux process sandbox that uses Landlock and seccomp to confine untrusted programs.
While using seccomp user notifications to enforce process limits, sandlock encountered intermittent shell pipeline failures: SIGCHLD can interrupt a pending fork notification and make fork return EINTR before it executes [1]. The same pre-execution interruption can leave an intercepted close returning EINTR with its descriptor still open. Receiving notifications eagerly only narrows the race, and WAIT_KILLABLE_RECV protects the task only after receipt. This series adds SECCOMP_FILTER_FLAG_RESTART_BEFORE_RECV so applications can opt in to restarting these unexecuted syscalls after the signal handler returns. Existing signal-driven cancellation remains unchanged unless the flag is enabled. The series includes regression tests and documentation. [1] https://github.com/multikernel/sandlock/issues/235 Cong Wang (3): seccomp: allow restarting interrupted unreceived notifications selftests/seccomp: cover restart of unreceived notifications docs/seccomp: describe the SECCOMP_FILTER_FLAG_RESTART_BEFORE_RECV flag .../userspace-api/seccomp_filter.rst | 29 ++ include/linux/seccomp.h | 3 +- include/uapi/linux/seccomp.h | 1 + kernel/seccomp.c | 16 +- tools/include/uapi/linux/seccomp.h | 1 + tools/testing/selftests/seccomp/seccomp_bpf.c | 354 ++++++++++++++++++ 6 files changed, 399 insertions(+), 5 deletions(-) base-commit: f2c53ea949c5048f96b3dbb5a5ee7131ce4ff2de -- 2.43.0
