seccomp: recheck the syscall after RET_TRACE

Browse source

When RET_TRACE triggers, a tracer may change a syscall into something that
should be filtered by seccomp. This re-runs seccomp after a trace event
to make sure things continue to pass.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andy Lutomirski <luto@kernel.org>

...

This commit is contained in:

Kees Cook 2016-06-01 19:29:15 -07:00

parent 8112c4f140

commit ce6526e8af

1 changed files with 18 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

21

kernel/seccomp.c

View file