mirror of
https://github.com/checkpoint-restore/criu.git
synced 2026-01-23 02:14:37 +00:00
0d8aec0c3a
Unfortunately, SECCOMP_MODE_FILTER is not currently exposed to userspace, so we can't checkpoint that. In any case, this is what we need to do for SECCOMP_MODE_STRICT, so let's do it. This patch works by first disabling seccomp for any processes who are going to have seccomp filters restored, then restoring the process (including the seccomp filters), and finally resuming the seccomp filters before detaching from the process. v2 changes: * update for kernel patch v2 * use protobuf enum for seccomp type * don't parse /proc/pid/status twice v3 changes: * get rid of extra CR_STAGE_SECCOMP_SUSPEND stage * only suspend seccomp in finalize_restore(), just before the unmap * restore the (same) seccomp state in threads too; also add a note about how this is slightly wrong, and that we should at least check for a mismatch Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
54 lines
1.5 KiB
Text
54 lines
1.5 KiB
Text
include scripts/utilities.mak
|
|
include scripts/feature-tests.mak
|
|
|
|
CONFIG := include/config.h
|
|
|
|
ifeq ($(call try-cc,$(LIBBSD_DEV_TEST),-lbsd),y)
|
|
LIBS += -lbsd
|
|
DEFINES += -DCONFIG_HAS_LIBBSD
|
|
endif
|
|
|
|
ifeq ($(call pkg-config-check,libselinux),y)
|
|
LIBS := -lselinux $(LIBS)
|
|
DEFINES += -DCONFIG_HAS_SELINUX
|
|
endif
|
|
|
|
$(CONFIG): scripts/utilities.mak scripts/feature-tests.mak include/config-base.h
|
|
$(E) " GEN " $@
|
|
$(Q) @echo '#ifndef __CR_CONFIG_H__' > $@
|
|
$(Q) @echo '#define __CR_CONFIG_H__' >> $@
|
|
$(Q) @echo '' >> $@
|
|
$(Q) @echo '#include "config-base.h"' >> $@
|
|
$(Q) @echo '' >> $@
|
|
ifeq ($(call try-cc,$(TCP_REPAIR_TEST),),y)
|
|
$(Q) @echo '#define CONFIG_HAS_TCP_REPAIR' >> $@
|
|
endif
|
|
ifeq ($(call try-cc,$(PRLIMIT_TEST),),y)
|
|
$(Q) @echo '#define CONFIG_HAS_PRLIMIT' >> $@
|
|
endif
|
|
ifeq ($(call try-cc,$(STRLCPY_TEST),$(LIBS)),y)
|
|
$(Q) @echo '#define CONFIG_HAS_STRLCPY' >> $@
|
|
endif
|
|
ifeq ($(call try-cc,$(STRLCAT_TEST),$(LIBS)),y)
|
|
$(Q) @echo '#define CONFIG_HAS_STRLCAT' >> $@
|
|
endif
|
|
ifeq ($(call try-cc,$(PTRACE_PEEKSIGINFO_TEST),),y)
|
|
$(Q) @echo '#define CONFIG_HAS_PEEKSIGINFO_ARGS' >> $@
|
|
endif
|
|
ifeq ($(call try-cc,$(PTRACE_SUSPEND_SECCOMP_TEST),),y)
|
|
$(Q) @echo '#define CONFIG_HAS_SUSPEND_SECCOMP' >> $@
|
|
endif
|
|
ifeq ($(VDSO),y)
|
|
$(Q) @echo '#define CONFIG_VDSO' >> $@
|
|
endif
|
|
ifeq ($(call try-cc,$(SETPROCTITLE_INIT_TEST),-lbsd),y)
|
|
$(Q) @echo '#define CONFIG_HAS_SETPROCTITLE_INIT' >> $@
|
|
endif
|
|
ifeq ($(piegen-y),y)
|
|
$(Q) @echo '#define CONFIG_PIEGEN' >> $@
|
|
endif
|
|
$(Q) @echo '#endif /* __CR_CONFIG_H__ */' >> $@
|
|
|
|
config: $(CONFIG)
|
|
|
|
.PHONY: config
|