Re: [PATCH v2 2/5] seccomp: make underlying bpf ref counted as well

2015-09-14 Thread Tycho Andersen
On Mon, Sep 14, 2015 at 06:48:43PM +0200, Daniel Borkmann wrote: > On 09/14/2015 06:00 PM, Tycho Andersen wrote: > >On Fri, Sep 11, 2015 at 08:28:19PM +0200, Daniel Borkmann wrote: > >>I think due to the given insns restrictions on classic seccomp, this > >>could work for "most cases" (see below) f

Re: [PATCH v2 2/5] seccomp: make underlying bpf ref counted as well

2015-09-14 Thread Daniel Borkmann
On 09/14/2015 06:00 PM, Tycho Andersen wrote: On Fri, Sep 11, 2015 at 08:28:19PM +0200, Daniel Borkmann wrote: I think due to the given insns restrictions on classic seccomp, this could work for "most cases" (see below) for the time being until pointer sanitation is resolved and that seccomp-onl

Re: [PATCH v2 2/5] seccomp: make underlying bpf ref counted as well

2015-09-14 Thread Tycho Andersen
Hi Daniel, On Fri, Sep 11, 2015 at 08:28:19PM +0200, Daniel Borkmann wrote: > I think due to the given insns restrictions on classic seccomp, this > could work for "most cases" (see below) for the time being until pointer > sanitation is resolved and that seccomp-only restriction from the dump > c

Re: [PATCH v2 2/5] seccomp: make underlying bpf ref counted as well

2015-09-11 Thread Daniel Borkmann
On 09/11/2015 07:33 PM, Tycho Andersen wrote: On Fri, Sep 11, 2015 at 06:03:59PM +0200, Daniel Borkmann wrote: On 09/11/2015 04:44 PM, Tycho Andersen wrote: On Fri, Sep 11, 2015 at 03:02:36PM +0200, Daniel Borkmann wrote: On 09/11/2015 02:20 AM, Tycho Andersen wrote: In the next patch, we're

Re: [PATCH v2 2/5] seccomp: make underlying bpf ref counted as well

2015-09-11 Thread Tycho Andersen
On Fri, Sep 11, 2015 at 06:03:59PM +0200, Daniel Borkmann wrote: > On 09/11/2015 04:44 PM, Tycho Andersen wrote: > >On Fri, Sep 11, 2015 at 03:02:36PM +0200, Daniel Borkmann wrote: > >>On 09/11/2015 02:20 AM, Tycho Andersen wrote: > >>>In the next patch, we're going to add a way to access the under

Re: [PATCH v2 2/5] seccomp: make underlying bpf ref counted as well

2015-09-11 Thread Daniel Borkmann
On 09/11/2015 04:44 PM, Tycho Andersen wrote: On Fri, Sep 11, 2015 at 03:02:36PM +0200, Daniel Borkmann wrote: On 09/11/2015 02:20 AM, Tycho Andersen wrote: In the next patch, we're going to add a way to access the underlying filters via bpf fds. This means that we need to ref-count both the st

Re: [PATCH v2 2/5] seccomp: make underlying bpf ref counted as well

2015-09-11 Thread Tycho Andersen
On Fri, Sep 11, 2015 at 03:02:36PM +0200, Daniel Borkmann wrote: > On 09/11/2015 02:20 AM, Tycho Andersen wrote: > >In the next patch, we're going to add a way to access the underlying > >filters via bpf fds. This means that we need to ref-count both the > >struct seccomp_filter objects and the str

Re: [PATCH v2 2/5] seccomp: make underlying bpf ref counted as well

2015-09-11 Thread Daniel Borkmann
On 09/11/2015 02:20 AM, Tycho Andersen wrote: In the next patch, we're going to add a way to access the underlying filters via bpf fds. This means that we need to ref-count both the struct seccomp_filter objects and the struct bpf_prog objects separately, in case a process dies but a filter is st

[PATCH v2 2/5] seccomp: make underlying bpf ref counted as well

2015-09-10 Thread Tycho Andersen
In the next patch, we're going to add a way to access the underlying filters via bpf fds. This means that we need to ref-count both the struct seccomp_filter objects and the struct bpf_prog objects separately, in case a process dies but a filter is still referred to by another process. Additionall