Mirrors/criu
1
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu.git synced 2026-01-23 02:14:37 +00:00
Code Issues Projects Releases Wiki Activity

seccomp: add initial support for SECCOMP_MODE_STRICT

Browse source 
Unfortunately, SECCOMP_MODE_FILTER is not currently exposed to userspace,
so we can't checkpoint that. In any case, this is what we need to do for
SECCOMP_MODE_STRICT, so let's do it.

This patch works by first disabling seccomp for any processes who are going
to have seccomp filters restored, then restoring the process (including the
seccomp filters), and finally resuming the seccomp filters before detaching
from the process.

v2 changes:

* update for kernel patch v2
* use protobuf enum for seccomp type
* don't parse /proc/pid/status twice

v3 changes:

* get rid of extra CR_STAGE_SECCOMP_SUSPEND stage
* only suspend seccomp in finalize_restore(), just before the unmap
* restore the (same) seccomp state in threads too; also add a note about
  how this is slightly wrong, and that we should at least check for a
  mismatch

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This commit is contained in:
Tycho Andersen 2015-06-18 11:59:16 -06:00 • committed by Pavel Emelyanov
parent bf4243e303
commit 0d8aec0c3a
14 changed files with 180 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Makefile.config
View file

@ -35,6 +35,9 @@ endif
ifeq ($(call try-cc,$(PTRACE_PEEKSIGINFO_TEST),),y)
$(Q) @echo '#define CONFIG_HAS_PEEKSIGINFO_ARGS' >> $@
endif
ifeq ($(call try-cc,$(PTRACE_SUSPEND_SECCOMP_TEST),),y)
$(Q) @echo '#define CONFIG_HAS_SUSPEND_SECCOMP' >> $@
endif
ifeq ($(VDSO),y)
$(Q) @echo '#define CONFIG_VDSO' >> $@
endif