| Message ID | 1441382664-17437-3-git-send-email-tycho.andersen@canonical.com |
|---|---|
| State | Changes Requested, archived |
| Delegated to: | David Miller |
| Headers | show |
On Fri, Sep 4, 2015 at 9:04 AM, Tycho Andersen <tycho.andersen@canonical.com> wrote: > Additionally, we mark classic converted seccomp filters as seccomp eBPF > programs, since they are a subset of what is supported in seccomp eBPF. Off the top of my head, I'm okay with this. --Andy -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/kernel/seccomp.c b/kernel/seccomp.c index 5bd4779..acfe1fb 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -377,6 +377,8 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) } atomic_set(&sfilter->usage, 1); + atomic_set(&sfilter->prog->aux->refcnt, 1); + sfilter->prog->type = BPF_PROG_TYPE_SECCOMP; return sfilter; } @@ -469,7 +471,7 @@ void get_seccomp_filter(struct task_struct *tsk) static inline void seccomp_filter_free(struct seccomp_filter *filter) { if (filter) { - bpf_prog_free(filter->prog); + bpf_prog_put(filter->prog); kfree(filter); } }
In the next patch, we're going to add a way to access the underlying filters via bpf fds. This means that we need to ref-count both the struct seccomp_filter objects and the struct bpf_prog objects separately, in case a process dies but a filter is still referred to by another process. Additionally, we mark classic converted seccomp filters as seccomp eBPF programs, since they are a subset of what is supported in seccomp eBPF. Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> CC: Kees Cook <keescook@chromium.org> CC: Will Drewry <wad@chromium.org> CC: Oleg Nesterov <oleg@redhat.com> CC: Andy Lutomirski <luto@amacapital.net> CC: Pavel Emelyanov <xemul@parallels.com> CC: Serge E. Hallyn <serge.hallyn@ubuntu.com> CC: Alexei Starovoitov <ast@kernel.org> CC: Daniel Borkmann <daniel@iogearbox.net> --- kernel/seccomp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)