| commit | bda08a5764d470f101fa38635d30b41179a313e1 | |
| author | Marc-André Lureau <marcandre.lureau@redhat.com> | |
| Wed, 22 Aug 2018 17:02:48 +0000 (22 19:02 +0200) | ||
| committer | Eduardo Otubo <otubo@redhat.com> | |
| Thu, 23 Aug 2018 14:45:23 +0000 (23 16:45 +0200) | ||
| tree | 48e29345c488e6dea698fff37f7fa710ed93f33e | treesnapshot (tar.gz zip) |
| parent | 6f2231e9b0931e1998d9ed0c509adf7aedc02db2 | commitdiff |
seccomp: prefer SCMP_ACT_KILL_PROCESS if available
The upcoming libseccomp release should have SCMP_ACT_KILL_PROCESS
action (https://github.com/seccomp/libseccomp/issues/96).
SCMP_ACT_KILL_PROCESS is preferable to immediately terminate the
offending process, rather than having the SIGSYS handler running.
Use SECCOMP_GET_ACTION_AVAIL to check availability of kernel support,
as libseccomp will fallback on SCMP_ACT_KILL otherwise, and we still
prefer SCMP_ACT_TRAP.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Eduardo Otubo <otubo@redhat.com>
The upcoming libseccomp release should have SCMP_ACT_KILL_PROCESS
action (https://github.com/seccomp/libseccomp/issues/96).
SCMP_ACT_KILL_PROCESS is preferable to immediately terminate the
offending process, rather than having the SIGSYS handler running.
Use SECCOMP_GET_ACTION_AVAIL to check availability of kernel support,
as libseccomp will fallback on SCMP_ACT_KILL otherwise, and we still
prefer SCMP_ACT_TRAP.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Eduardo Otubo <otubo@redhat.com>
| qemu-seccomp.c | diffblobblamehistory |