On Mon, Jun 01, 2020 at 09:32:02AM -0300, Thadeu Lima de Souza Cascardo wrote: > As seccomp_benchmark tries to calibrate how many samples will take more > than 5 seconds to execute, it may end up picking up a number of samples > that take 10 (but up to 12) seconds. As the calibration will take double > that time, it takes around 20 seconds. Then, it executes the whole thing > again, and then once more, with some added overhead. So, the thing might > take more than 40 seconds, which is too close to the 45s timeout. > > That is very dependent on the system where it's executed, so may not be > observed always, but it has been observed on x86 VMs. Using a 90s timeout > seems safe enough. > > Signed-off-by: Thadeu Lima de Souza Cascardo <[email protected]>
Excellent point! Thanks, I've applied this (well, actually, your v2) to for-next/seccomp. -- Kees Cook
