Quoting Stéphane Graber ([email protected]): > On Wed, Feb 12, 2014 at 03:50:20PM -0600, Serge Hallyn wrote: > > v2 allows specifying system calls by name, and specifying > > architecture. A policy looks like: > > > > 2 > > whitelist > > open > > read > > write > > close > > mount > > [x86] > > open > > read > > > > Also use SCMP_ACT_KILL by default rather than SCMP_ACT_ERRNO(31) - > > which confusingly returns 'EMLINK' on x86_64. Note this change > > is also done for v1 as I think it is worthwhile. > > > > With this patch, I can in fact use a seccomp policy like: > > > > 2 > > blacklist > > mknod errno 0 > > > > after which 'sudo mknod null c 1 3' silently succeeds without > > creating the null device. > > > > changelog v2: > > add blacklist support > > support default action > > support per-rule action > > > > Signed-off-by: Serge Hallyn <[email protected]> > > Looks good to me. Can I just ask you to send another patch updating our > documentation? It currently only lists v1 and says that only whitelist > is allowed (lxc.container.conf.sgml). Adding seccomp-v1 and seccomp-v2 > example files to doc/ may also be worthwhile.
Yup, will do. _______________________________________________ lxc-devel mailing list [email protected] http://lists.linuxcontainers.org/listinfo/lxc-devel
