Re: [PATCH v12 11/11] seccomp: add thread sync ability

2014-07-18 Thread Kees Cook
On Fri, Jul 18, 2014 at 11:51 AM, Andy Lutomirski wrote: > On Fri, Jul 18, 2014 at 11:13 AM, Kees Cook wrote: >> On Fri, Jul 18, 2014 at 10:17 AM, Andy Lutomirski >> wrote: >>> On Thu, Jul 17, 2014 at 8:26 PM, James Morris wrote: On Thu, 17 Jul 2014, Kees Cook wrote: > Twelfth ti

Re: [PATCH v12 11/11] seccomp: add thread sync ability

2014-07-18 Thread Andy Lutomirski
On Fri, Jul 18, 2014 at 11:13 AM, Kees Cook wrote: > On Fri, Jul 18, 2014 at 10:17 AM, Andy Lutomirski wrote: >> On Thu, Jul 17, 2014 at 8:26 PM, James Morris wrote: >>> On Thu, 17 Jul 2014, Kees Cook wrote: >>> Twelfth time's the charm! :) >>> >>> Btw, there doesn't seem to be an official

Re: [PATCH v12 11/11] seccomp: add thread sync ability

2014-07-18 Thread Kees Cook
On Fri, Jul 18, 2014 at 10:17 AM, Andy Lutomirski wrote: > On Thu, Jul 17, 2014 at 8:26 PM, James Morris wrote: >> On Thu, 17 Jul 2014, Kees Cook wrote: >> >>> Twelfth time's the charm! :) >> >> Btw, there doesn't seem to be an official seccomp maintainer. Kees, would >> you like to volunteer fo

Re: [PATCH v12 11/11] seccomp: add thread sync ability

2014-07-18 Thread Andy Lutomirski
On Thu, Jul 17, 2014 at 8:26 PM, James Morris wrote: > On Thu, 17 Jul 2014, Kees Cook wrote: > >> Twelfth time's the charm! :) > > Btw, there doesn't seem to be an official seccomp maintainer. Kees, would > you like to volunteer for this? If so, send in a patch for MAINTAINERS, > and set up a gi

Re: [PATCH v12 11/11] seccomp: add thread sync ability

2014-07-17 Thread James Morris
On Thu, 17 Jul 2014, Kees Cook wrote: > Twelfth time's the charm! :) Btw, there doesn't seem to be an official seccomp maintainer. Kees, would you like to volunteer for this? If so, send in a patch for MAINTAINERS, and set up a git tree for me to pull from. -- James Morris -- To unsubsc

[PATCH v12 11/11] seccomp: add thread sync ability

2014-07-17 Thread Kees Cook
Twelfth time's the charm! :) This adds the ability for threads to request seccomp filter synchronization across their thread group (at filter attach time). For example, for Chrome to make sure graphic driver threads are fully confined after seccomp filters have been attached. To support this, loc