diff options
| author | Brian Geffon <bgeffon@google.com> | 2018-08-02 08:09:03 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2018-08-02 08:10:30 -0700 |
| commit | cf44aff6e08b0e19935d5cd98455b4af98fd8794 (patch) | |
| tree | b4c95523871f54a8ec739a426bb0cc84f7f11b48 /pkg/sentry/kernel/task_syscall.go | |
| parent | 3cd7824410302da00d1c8c8323db8959a124814a (diff) | |
Add seccomp(2) support.
Add support for the seccomp syscall and the flag SECCOMP_FILTER_FLAG_TSYNC.
PiperOrigin-RevId: 207101507
Change-Id: I5eb8ba9d5ef71b0e683930a6429182726dc23175
Diffstat (limited to 'pkg/sentry/kernel/task_syscall.go')
| -rw-r--r-- | pkg/sentry/kernel/task_syscall.go | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/pkg/sentry/kernel/task_syscall.go b/pkg/sentry/kernel/task_syscall.go index 79f4ff60c..92ca0acd9 100644 --- a/pkg/sentry/kernel/task_syscall.go +++ b/pkg/sentry/kernel/task_syscall.go @@ -194,7 +194,7 @@ func (t *Task) doSyscall() taskRunState { // Check seccomp filters. The nil check is for performance (as seccomp use // is rare), not needed for correctness. - if t.syscallFilters != nil { + if t.syscallFilters.Load() != nil { switch r := t.checkSeccompSyscall(int32(sysno), args, usermem.Addr(t.Arch().IP())); r { case seccompResultDeny: t.Debugf("Syscall %d: denied by seccomp", sysno) @@ -334,7 +334,7 @@ func (t *Task) doVsyscall(addr usermem.Addr, sysno uintptr) taskRunState { // to syscall ABI because they both use RDI, RSI, and RDX for the first three // arguments and none of the vsyscalls uses more than two arguments. args := t.Arch().SyscallArgs() - if t.syscallFilters != nil { + if t.syscallFilters.Load() != nil { switch r := t.checkSeccompSyscall(int32(sysno), args, addr); r { case seccompResultDeny: t.Debugf("vsyscall %d, caller %x: denied by seccomp", sysno, t.Arch().Value(caller)) |