On Thu, Sep 06, 2018 at 06:15:18PM +0200, Jann Horn wrote:

On Thu, Sep 6, 2018 at 5:29 PM Tycho Andersen [off-list ref] wrote:

quoted

The idea here is that the userspace handler should be able to pass an fd
back to the trapped task, for example so it can be returned from socket().

[...]

quoted

diff --git a/Documentation/userspace-api/seccomp_filter.rst b/Documentation/userspace-api/seccomp_filter.rst
index d1498885c1c7..1c0aab306426 100644
--- a/Documentation/userspace-api/seccomp_filter.rst
+++ b/Documentation/userspace-api/seccomp_filter.rst

@@ -235,6 +235,9 @@ The interface for a seccomp notification fd consists of two structures:
         __u64 id;
         __s32 error;
         __s64 val;
+        __u8 return_fd;
+        __u32 fd;
+        __u32 fd_flags;

Normally,  syscalls that take an optional file descriptor accept a
signed 32-bit number, with -1 standing for "no file descriptor". Is
there a reason why this uses a separate variable to signal whether an
fd was provided?

No real reason other than I looked at the bpf code and they were using
__u32 for bpf (but I think in their case the fd args are not
optional). I'll switch it to __s32/-1 for the next version.

Apart from that, this patch looks good to me.

Thanks,

Tycho