From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752192AbdHCDTe (ORCPT ); Wed, 2 Aug 2017 23:19:34 -0400 Received: from mail-pg0-f41.google.com ([74.125.83.41]:33854 "EHLO mail-pg0-f41.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752011AbdHCDTa (ORCPT ); Wed, 2 Aug 2017 23:19:30 -0400 From: Kees Cook To: linux-kernel@vger.kernel.org Cc: Kees Cook , Fabricio Voznika , Tyler Hicks , Andy Lutomirski , Will Drewry , Shuah Khan , linux-kselftest@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH 0/4] seccomp: Add SECCOMP_FILTER_FLAG_KILL_PROCESS Date: Wed, 2 Aug 2017 20:19:09 -0700 Message-Id: <1501730353-46840-1-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This series is the result of Fabricio and I going around a few times on possible solutions for finding a way to enhance RET_KILL to kill the process group. There's a lot of ways this could be done, but I wanted something that felt cleanest. As it happens, Tyler's recent patch series for logging improvement also needs to know a litte bit more during filter runs, and the solution for both is to pass back the matched filter. This lets us examine it here for RET_KILL and in the future for logging changes. The filter passing is patch 1, the new flag for RET_KILL is patch 2. Some test refactoring is in patch 3 for the RET_DATA ordering, and patch 4 is the test for the new RET_KILL flag. Please take a look! Thanks, -Kees