Re: [PATCH v7 0/6] seccomp trap to userspace

On Fri, Sep 28, 2018 at 11:57:40PM +0200, Michael Kerrisk (man-opages) wrote:

Hi Tycho,

On 09/27/2018 05:11 PM, Tycho Andersen wrote:

quoted

Hi all,

Here's v7 of the seccomp trap to userspace set. There are various minor
changes and bug fixes, but two major changes:

* We now pass fds to the tracee via an ioctl, and do it immediately when
   the ioctl is called. For this we needed some help from the vfs, so
   I've put the one patch in this series and cc'd fsdevel. This does have
   the advantage that the feature is now totally decoupled from the rest
   of the set, which is itself useful (thanks Andy!)

* Instead of putting all of the notification related stuff into the
   struct seccomp_filter, it now lives in its own struct notification,
   which is pointed to by struct seccomp_filter. This will save a lot of
   memory (thanks Tyler!)

Is there a documentation (man page) patch for this API change?

Not yet, but once we decide on a final API I'll prepare one.

Cheers,

Tycho