Re: [PATCH 2/4] seccomp: Add SECCOMP_FILTER_FLAG_KILL_PROCESS

2017-08-07 Thread Kees Cook
On Mon, Aug 7, 2017 at 6:23 PM, Tyler Hicks wrote: > On 08/02/2017 10:19 PM, Kees Cook wrote: >> Right now, SECCOMP_RET_KILL kills the current thread. There have been >> a few requests for RET_KILL to kill the entire process (the thread >> group), but since seccomp's u32

Re: [PATCH 2/4] seccomp: Add SECCOMP_FILTER_FLAG_KILL_PROCESS

2017-08-07 Thread Kees Cook
On Mon, Aug 7, 2017 at 6:23 PM, Tyler Hicks wrote: > On 08/02/2017 10:19 PM, Kees Cook wrote: >> Right now, SECCOMP_RET_KILL kills the current thread. There have been >> a few requests for RET_KILL to kill the entire process (the thread >> group), but since seccomp's u32 return values are ABI,

Re: [PATCH 2/4] seccomp: Add SECCOMP_FILTER_FLAG_KILL_PROCESS

2017-08-07 Thread Tyler Hicks
On 08/02/2017 10:19 PM, Kees Cook wrote: > Right now, SECCOMP_RET_KILL kills the current thread. There have been > a few requests for RET_KILL to kill the entire process (the thread > group), but since seccomp's u32 return values are ABI, and ordered by > lowest value, with RET_KILL as 0, there

Re: [PATCH 2/4] seccomp: Add SECCOMP_FILTER_FLAG_KILL_PROCESS

2017-08-07 Thread Tyler Hicks
On 08/02/2017 10:19 PM, Kees Cook wrote: > Right now, SECCOMP_RET_KILL kills the current thread. There have been > a few requests for RET_KILL to kill the entire process (the thread > group), but since seccomp's u32 return values are ABI, and ordered by > lowest value, with RET_KILL as 0, there

[PATCH 2/4] seccomp: Add SECCOMP_FILTER_FLAG_KILL_PROCESS

2017-08-02 Thread Kees Cook
Right now, SECCOMP_RET_KILL kills the current thread. There have been a few requests for RET_KILL to kill the entire process (the thread group), but since seccomp's u32 return values are ABI, and ordered by lowest value, with RET_KILL as 0, there isn't a trivial way to provide an even smaller

[PATCH 2/4] seccomp: Add SECCOMP_FILTER_FLAG_KILL_PROCESS

2017-08-02 Thread Kees Cook
Right now, SECCOMP_RET_KILL kills the current thread. There have been a few requests for RET_KILL to kill the entire process (the thread group), but since seccomp's u32 return values are ABI, and ordered by lowest value, with RET_KILL as 0, there isn't a trivial way to provide an even smaller