Re: [PATCH v3 3/4] seccomp: notify about unused filter

2020-06-02 Thread Christian Brauner
On Mon, Jun 01, 2020 at 12:29:27PM -0700, Kees Cook wrote: > On Sun, May 31, 2020 at 01:50:30PM +0200, Christian Brauner wrote: > > We've been making heavy use of the seccomp notifier to intercept and > > handle certain syscalls for containers. This patch allows a syscall > > supervisor listening o

Re: [PATCH v3 3/4] seccomp: notify about unused filter

2020-06-01 Thread Kees Cook
On Sun, May 31, 2020 at 01:50:30PM +0200, Christian Brauner wrote: > We've been making heavy use of the seccomp notifier to intercept and > handle certain syscalls for containers. This patch allows a syscall > supervisor listening on a given notifier to be notified when a seccomp > filter has becom

[PATCH v3 3/4] seccomp: notify about unused filter

2020-05-31 Thread Christian Brauner
We've been making heavy use of the seccomp notifier to intercept and handle certain syscalls for containers. This patch allows a syscall supervisor listening on a given notifier to be notified when a seccomp filter has become unused. A container is often managed by a singleton supervisor process t