Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Eric Paris
On Fri, 2013-03-15 at 11:45 -0700, Kees Cook wrote: > On Fri, Mar 15, 2013 at 11:28 AM, Nicolas Schichan > wrote: > > diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h > > index 6f19cfd..af27494 100644 > > --- a/include/linux/seccomp.h > > +++ b/include/linux/seccomp.h > > @@ -6,6

Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Nicolas Schichan
On 03/15/2013 08:22 PM, Kees Cook wrote: On Fri, Mar 15, 2013 at 12:10 PM, Nicolas Schichan wrote: On 03/15/2013 07:45 PM, Kees Cook wrote: Yes, I did not realise that this header was exported to userspace. Do you know any place not exported to userspace where the structure definition would

Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Kees Cook
On Fri, Mar 15, 2013 at 12:10 PM, Nicolas Schichan wrote: > On 03/15/2013 07:45 PM, Kees Cook wrote: >> >> On Fri, Mar 15, 2013 at 11:28 AM, Nicolas Schichan >> wrote: >>> >>> +/** >>> + * struct seccomp_filter - container for seccomp BPF programs >>> + * >>> + * @usage: reference count to

Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Nicolas Schichan
On 03/15/2013 07:45 PM, Kees Cook wrote: On Fri, Mar 15, 2013 at 11:28 AM, Nicolas Schichan wrote: +/** + * struct seccomp_filter - container for seccomp BPF programs + * + * @usage: reference count to manage the object lifetime. + * get/put helpers should be used when accessing an

Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Kees Cook
On Fri, Mar 15, 2013 at 11:28 AM, Nicolas Schichan wrote: > Architecture must select HAVE_SECCOMP_FILTER_JIT and implement > seccomp_jit_compile() and seccomp_jit_free() if they intend to support > jitted seccomp filters. > > struct seccomp_filter has been moved to to make its > content

Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Nicolas Schichan
On 03/15/2013 07:28 PM, Nicolas Schichan wrote: [Sorry, I forgot to put the mailing lists as the receivers of the introductory message] Hi, This patch serie adds support for jitted seccomp BPF filters, with the required modifications to make it work on the ARM architecture. - The first patch

[PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Nicolas Schichan
Architecture must select HAVE_SECCOMP_FILTER_JIT and implement seccomp_jit_compile() and seccomp_jit_free() if they intend to support jitted seccomp filters. struct seccomp_filter has been moved to to make its content available to the jit compilation code. In a way similar to the net BPF, the

[PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Nicolas Schichan
Architecture must select HAVE_SECCOMP_FILTER_JIT and implement seccomp_jit_compile() and seccomp_jit_free() if they intend to support jitted seccomp filters. struct seccomp_filter has been moved to linux/seccomp.h to make its content available to the jit compilation code. In a way similar to the

Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Nicolas Schichan
On 03/15/2013 07:28 PM, Nicolas Schichan wrote: [Sorry, I forgot to put the mailing lists as the receivers of the introductory message] Hi, This patch serie adds support for jitted seccomp BPF filters, with the required modifications to make it work on the ARM architecture. - The first patch

Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Kees Cook
On Fri, Mar 15, 2013 at 11:28 AM, Nicolas Schichan nschic...@freebox.fr wrote: Architecture must select HAVE_SECCOMP_FILTER_JIT and implement seccomp_jit_compile() and seccomp_jit_free() if they intend to support jitted seccomp filters. struct seccomp_filter has been moved to linux/seccomp.h

Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Nicolas Schichan
On 03/15/2013 07:45 PM, Kees Cook wrote: On Fri, Mar 15, 2013 at 11:28 AM, Nicolas Schichan nschic...@freebox.fr wrote: +/** + * struct seccomp_filter - container for seccomp BPF programs + * + * @usage: reference count to manage the object lifetime. + * get/put helpers should be used

Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Kees Cook
On Fri, Mar 15, 2013 at 12:10 PM, Nicolas Schichan nschic...@freebox.fr wrote: On 03/15/2013 07:45 PM, Kees Cook wrote: On Fri, Mar 15, 2013 at 11:28 AM, Nicolas Schichan nschic...@freebox.fr wrote: +/** + * struct seccomp_filter - container for seccomp BPF programs + * + * @usage:

Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Nicolas Schichan
On 03/15/2013 08:22 PM, Kees Cook wrote: On Fri, Mar 15, 2013 at 12:10 PM, Nicolas Schichan nschic...@freebox.fr wrote: On 03/15/2013 07:45 PM, Kees Cook wrote: Yes, I did not realise that this header was exported to userspace. Do you know any place not exported to userspace where the

Re: [PATCH RFC 1/3] seccomp: add generic code for jitted seccomp filters.

2013-03-15 Thread Eric Paris
On Fri, 2013-03-15 at 11:45 -0700, Kees Cook wrote: On Fri, Mar 15, 2013 at 11:28 AM, Nicolas Schichan nschic...@freebox.fr wrote: diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h index 6f19cfd..af27494 100644 --- a/include/linux/seccomp.h +++ b/include/linux/seccomp.h