From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21B8FC43603 for ; Tue, 17 Dec 2019 02:07:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E9CBF2176D for ; Tue, 17 Dec 2019 02:07:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726723AbfLQCH1 (ORCPT ); Mon, 16 Dec 2019 21:07:27 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:39870 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726180AbfLQCH1 (ORCPT ); Mon, 16 Dec 2019 21:07:27 -0500 Received: from [213.220.153.21] (helo=wittgenstein) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1ih2Gj-000354-4v; Tue, 17 Dec 2019 02:07:25 +0000 Date: Tue, 17 Dec 2019 03:07:24 +0100 From: Christian Brauner To: Sargun Dhillon Cc: linux-kernel@vger.kernel.org, containers@lists.linux-foundation.org, linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org, tycho@tycho.ws, jannh@google.com, cyphar@cyphar.com, oleg@redhat.com, luto@amacapital.net, viro@zeniv.linux.org.uk, gpascutto@mozilla.com, ealvarez@mozilla.com, fweimer@redhat.com, jld@mozilla.com Subject: Re: [PATCH v3 4/4] samples: Add example of using pidfd getfd in conjunction with user trap Message-ID: <20191217020723.cluy5x2kg5q3ithf@wittgenstein> References: <20191217010025.GA14479@ircssh-2.c.rugged-nimbus-611.internal> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20191217010025.GA14479@ircssh-2.c.rugged-nimbus-611.internal> User-Agent: NeoMutt/20180716 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Dec 17, 2019 at 01:00:27AM +0000, Sargun Dhillon wrote: > This sample adds the usage of SECCOMP_RET_USER_NOTIF together with pidfd > GETFD ioctl. It shows trapping a syscall, and handling it by extracting > the FD into the parent process without stopping the child process. > Although, in this example, there's no explicit policy separation in > the two processes, it can be generalized into the example of a transparent > proxy. > > Signed-off-by: Sargun Dhillon > --- > samples/seccomp/.gitignore | 1 + > samples/seccomp/Makefile | 9 +- > samples/seccomp/user-trap-pidfd.c | 190 ++++++++++++++++++++++++++++++ This is a great sample. Could you please also add tests without seccomp to the pidfd-testsuite itself under tools/testing/selftests/pidfd. I want to have all pidfd features tested in one place so that people don't need to run seccomp-bpf, or compile the optional samples but can just run the pidfd test-suite and it'll bang on all features. Christian