[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [RFC] [PATCHv2 2/2] Adding basic calls to libseccomp in

From: Corey Bryant
Subject: Re: [Qemu-devel] [RFC] [PATCHv2 2/2] Adding basic calls to libseccomp in vl.c
Date: Mon, 02 Jul 2012 10:20:56 -0400
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20120615 Thunderbird/13.0.1

On 07/01/2012 10:18 PM, Will Drewry wrote:
On Sun, Jul 1, 2012 at 8:25 AM, Paolo Bonzini <address@hidden> wrote:
Il 18/06/2012 23:53, Corey Bryant ha scritto:

Can each thread have separate seccomp whitelists? For example CPU
threads should not need pretty much anything but the I/O thread needs

No, seccomp filters are defined and enforced at the process level.

Perhaps we can add (at the kernel level) a way for seccomp filters to
examine the current tid.

Sorry for the confusion. I corrected my statement in a later thread based on Will's input: http://lists.nongnu.org/archive/html/qemu-devel/2012-06/msg03212.html

seccomp filters are attached to the task_struct and apply per "thread"
or per process since they both get their own task_structs.  (For
Linux, process==thread with shared resources.)  Filter programs are
also inherited across clone/fork, so it's possible to install a
"global" filter program which applies which is inherited during thread
creation, then apply per-thread refinements by stacking on additional
filters (at the cost of additional evaluation time).




reply via email to

[Prev in Thread] Current Thread [Next in Thread]