Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system callfiltering

* David Laight [off-list ref] wrote:

[...] unfortunately it worked by looking at the user-space buffers on system 
call entry - and a multithreaded program can easily arrange to update them 
after the initial check! [...]

Such problems of reliability/persistency of security checks is exactly one of 
my arguments why this should not be limited to the syscall boundary, if you 
read the example i have provided in this discussion.

Thanks,

	Ingo