Re: [PATCH v8 3/8] seccomp: add system call filtering using BPF

On 02/16/2012 04:51 PM, Andrew Lutomirski wrote:

IMO the best solution is to have the One True Seccomp Filter Compiler
(tm).  It would handle multiple namespaces, cross-arch differences,
and such, and it would do it correctly.  It could live in the kernel
tree.

Without something like that or an incredible amount of special care,
actual portability is probably a pipe dream.

--Andy

Seconded!

	-hpa

-- 
H. Peter Anvin, Intel Open Source Technology Center
I work for Intel.  I don't speak on their behalf.