brain-hackers_pepepper-mirror
/
linux-brain
mirror of https://github.com/brain-hackers/linux-brain.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Documentation: seccomp: Fix user notification documentation 

commit aac902925ea646e461c95edc98a8a57eb0def917 upstream.

The documentation had some previously incorrect information about how
userspace notifications (and responses) were handled due to a change
from a previously proposed patchset.

Signed-off-by: Sargun Dhillon <sargun@sargun.me>
Acked-by: Tycho Andersen <tycho@tycho.pizza>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Fixes: 6a21cc50f0 ("seccomp: add a return code to trap to userspace")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210517193908.3113-2-sargun@sargun.me
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Sargun Dhillon 2021-05-17 12:39:05 -07:00 committed by Greg Kroah-Hartman
parent c7c6a316a8
commit 48a9b7957b
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
Documentation/userspace-api/seccomp_filter.rst
View File

@ -250,14 +250,14 @@ Users can read via ``ioctl(SECCOMP_IOCTL_NOTIF_RECV)`` (or ``poll()``) on a
seccomp notification fd to receive a ``struct seccomp_notif``, which contains seccomp notification fd to receive a ``struct seccomp_notif``, which contains
five members: the input length of the structure, a unique-per-filter ``id``, five members: the input length of the structure, a unique-per-filter ``id``,
the ``pid`` of the task which triggered this request (which may be 0 if the the ``pid`` of the task which triggered this request (which may be 0 if the
task is in a pid ns not visible from the listener's pid namespace), a ``flags`` task is in a pid ns not visible from the listener's pid namespace). The
member which for now only has ``SECCOMP_NOTIF_FLAG_SIGNALED``, representing notification also contains the ``data`` passed to seccomp, and a filters flag.
whether or not the notification is a result of a non-fatal signal, and the The structure should be zeroed out prior to calling the ioctl.
``data`` passed to seccomp. Userspace can then make a decision based on this
information about what to do, and ``ioctl(SECCOMP_IOCTL_NOTIF_SEND)`` a Userspace can then make a decision based on this information about what to do,
response, indicating what should be returned to userspace. The ``id`` member of and ``ioctl(SECCOMP_IOCTL_NOTIF_SEND)`` a response, indicating what should be
``struct seccomp_notif_resp`` should be the same ``id`` as in ``struct returned to userspace. The ``id`` member of ``struct seccomp_notif_resp`` should
seccomp_notif``. be the same ``id`` as in ``struct seccomp_notif``.
It is worth noting that ``struct seccomp_data`` contains the values of register It is worth noting that ``struct seccomp_data`` contains the values of register
arguments to the syscall, but does not contain pointers to memory. The task's arguments to the syscall, but does not contain pointers to memory. The task's