Re: [patch] let CONFIG_SECCOMP default to n

[Ingo Molnar]

* Jeff Dike <jdike@xxxxxxxxxxx> wrote:

> Now, there were a couple of ways to legitimately escape from UML, and 
> they *did* involve ptrace.  Things like single-stepping a system call 
> instruction or putting a breakpoint on a system call instruction and 
> single-stepping from the breakpoint.  As far as I know, these were 
> discovered and fixed by UML developers before there was any outside 
> awareness of these bugs.

also, UML 'ptrace clients' are allowed alot more leeway than what a 
seccomp-alike ptrace/utrace based syscall filter would allow. It would 
clearly exclude activities like 'setting a breakpoint' or 
'single-stepping' - valid syscalls would be limited to 
read/write/sigreturn/exit.

	Ingo
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/