Re: [PATCH v8 2/2] samples: add an example of seccomp user trap

2018-10-29 Thread Tycho Andersen
On Mon, Oct 29, 2018 at 11:31:00PM +, Serge E. Hallyn wrote: > On Mon, Oct 29, 2018 at 04:40:31PM -0600, Tycho Andersen wrote: > > + if (req->data.nr != __NR_mount) { > > + fprintf(stderr, "huh? trapped something besides mknod? %d\n", > > req->data.nr); > > 'besides mount' ?

Re: [PATCH v8 2/2] samples: add an example of seccomp user trap

2018-10-29 Thread Tycho Andersen
On Mon, Oct 29, 2018 at 11:31:00PM +, Serge E. Hallyn wrote: > On Mon, Oct 29, 2018 at 04:40:31PM -0600, Tycho Andersen wrote: > > + if (req->data.nr != __NR_mount) { > > + fprintf(stderr, "huh? trapped something besides mknod? %d\n", > > req->data.nr); > > 'besides mount' ?

Re: [PATCH v8 2/2] samples: add an example of seccomp user trap

2018-10-29 Thread Serge E. Hallyn
On Mon, Oct 29, 2018 at 04:40:31PM -0600, Tycho Andersen wrote: > The idea here is just to give a demonstration of how one could safely use > the SECCOMP_RET_USER_NOTIF feature to do mount policies. This particular > policy is (as noted in the comment) not very interesting, but it serves to >

Re: [PATCH v8 2/2] samples: add an example of seccomp user trap

2018-10-29 Thread Serge E. Hallyn
On Mon, Oct 29, 2018 at 04:40:31PM -0600, Tycho Andersen wrote: > The idea here is just to give a demonstration of how one could safely use > the SECCOMP_RET_USER_NOTIF feature to do mount policies. This particular > policy is (as noted in the comment) not very interesting, but it serves to >

[PATCH v8 2/2] samples: add an example of seccomp user trap

2018-10-29 Thread Tycho Andersen
The idea here is just to give a demonstration of how one could safely use the SECCOMP_RET_USER_NOTIF feature to do mount policies. This particular policy is (as noted in the comment) not very interesting, but it serves to illustrate how one might apply a policy dodging the various TOCTOU issues.

[PATCH v8 2/2] samples: add an example of seccomp user trap

2018-10-29 Thread Tycho Andersen
The idea here is just to give a demonstration of how one could safely use the SECCOMP_RET_USER_NOTIF feature to do mount policies. This particular policy is (as noted in the comment) not very interesting, but it serves to illustrate how one might apply a policy dodging the various TOCTOU issues.